On Tue, Mar 05, 2013 at 05:11:29PM +0100, Pavel Březina wrote:
On 03/04/2013 07:34 PM, Simo Sorce wrote:
>On Mon, 2013-03-04 at 13:29 -0500, Simo Sorce wrote:
>>On Mon, 2013-03-04 at 13:10 +0100, Pavel Březina wrote:
>>>On 02/28/2013 12:29 AM, Simo Sorce wrote:
>>>>This patch removes yet another set of custom and parallel error codes
>>>>specified in the sdap_result enumeration, and instead uses the new
>>>>unified error codes.
>>>>
>>>>This is to be applied on top of the previous patchset that adds SSSD
>>>>specific error codes.
>>>>
>>>>I have done minimal testing with my IPA install and it seems to work
>>>>fine as far as ldap+SASL/GSSAPI auth goes.
>>>>
>>>>Simo.
>>>>
>>>
>>>Hi,
>>>
>>>>@@ -771,14 +776,19 @@ static struct tevent_req *sasl_bind_send(TALLOC_CTX
*memctx,
>>>> if (ret) goto fail;
>>>> }
>>>>
>>>>+ /* This is a hack, relies on the fact that tevent_req_done() will
only set
>>>>+ * the state if no callback has been set yet
>>>
>>>This is not true. tevent_req_done() always sets the state, even if
>>>there is no callback yet.
>>
>>I think my wording was misleading.
>>
>>What I meant here is that tevent_req_done *only* sets they state, and if
>>no callback is set nothing bad will happen. I will reword it so that it
>>more clear.
>>
>>>and then the immediate event
>>>>+ * set up by tevent_req_post() will call the async callback set by
the
>>>>+ * caller right after we return */
>>>>+ tevent_req_done(req);
>>>> tevent_req_post(req, ev);
>>>> return req;
>>>>
>>>> fail:
>>>>- if (ret == LDAP_SERVER_DOWN) {
>>>>+ if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT) {
>>>> tevent_req_error(req, ETIMEDOUT);
>>>> } else {
>>>>- tevent_req_error(req, EIO);
>>>>+ tevent_req_error(req, ERR_AUTH_FAILED);
>>>> }
>>>> tevent_req_post(req, ev);
>>>> return req;
>>>
>>>Otherwise it seems to be working correctly. I correct password,
>>>incorrect password, changing password, password expiration,
>>>enable/disable user with both LDAP (without kerberos) and IPA.
>>
>>Excellent, thanks!
>
>Patch with reworded comment attached.
>
>Simo.
This is much better. Ack.
It seems that at least some error codes are mishandled. When I attempt
to auth with a bad password, SSSD returns System Error. This is not what
we want, for some display managers (xdm and I thin even kdm) the System
Error retval would mean a popup is displayed to the user.
Auth, GSSAPI auth and offline auth works fine, though.