On Thu, Apr 22, 2010 at 10:44:40AM -0400, Stephen Gallagher wrote:
On 04/15/2010 07:10 AM, Sumit Bose wrote:
> Hi,
>
> these two patches provides a new attempt for the IPA password migration
> feature. The first one wraps the Kerberos authentication in the Kerberos
> provider into a tevent request to make it easy accessible for IPA
> authentication. The LDAP provider already has all needed features as
> tevent requests.
>
> The second patch changes IPA auth to use only tevent request from the
> LDAP and Kerberos provider. The ipaMigrationEnabled flag is read from
> the server, too.
>
> Both patches only apply to sssd-1-2. Because of the sync sysdb patches
> in master it is not easy to merge the first patch. I will rewrite the
> first patch and provider the patches for master if we agree that the way
> the two patches here handle password migration is the way we want to go.
>
> bye,
> Sumit
Patch 0001: Nack.
There are several places in krb5_auth_send() that return
tevent_req_error() that should not (e.g. we're offline and trying to do
a chpass or we don't handle a particular PAM command). We should reserve
tevent_req_error for internal errors like ENOMEM or broken configuration.
done
In krb5_find_ccache_step:
if (kr->ccname == NULL ||
(be_is_offline(state->be_ctx) && !kr->active_ccache_present
&&
!kr->valid_tgt_present) ||
(!be_is_offline(state->be_ctx) && !kr->active_ccache_present))
Should be:
if((kr->ccname == NULL || !kr->active_ccache_present ||
(be_is_offline(be_req->be_ctx) && !kr->valid_tgt_present))
The original version is the correct version. The second version was
suggested by me on irc during a discussion on how to make this condition
better understandable, but it misses the case that we always want to
keep a valid tgt if we are offline. I have added a comment which tries
to explain the condition.
A new version is attached.
bye,
Sumit
Patch 0002 review forthcoming.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel