[SSSD] [PATCH] IPA password migration (sssd-1-2 only)

Stephen Gallagher sgallagh at redhat.com
Thu Apr 22 14:44:40 UTC 2010


On 04/15/2010 07:10 AM, Sumit Bose wrote:
> Hi,
>
> these two patches provides a new attempt for the IPA password migration
> feature. The first one wraps the Kerberos authentication in the Kerberos
> provider into a tevent request to make it easy accessible for IPA
> authentication. The LDAP provider already has all needed features as
> tevent requests.
>
> The second patch changes IPA auth to use only tevent request from the
> LDAP and Kerberos provider. The ipaMigrationEnabled flag is read from
> the server, too.
>
> Both patches only apply to sssd-1-2. Because of the sync sysdb patches
> in master it is not easy to merge the first patch. I will rewrite the
> first patch and provider the patches for master if we agree that the way
> the two patches here handle password migration is the way we want to go.
>
> bye,
> Sumit


Patch 0001: Nack.
There are several places in krb5_auth_send() that return 
tevent_req_error() that should not (e.g. we're offline and trying to do 
a chpass or we don't handle a particular PAM command). We should reserve 
tevent_req_error for internal errors like ENOMEM or broken configuration.

In krb5_find_ccache_step:
     if (kr->ccname == NULL ||
         (be_is_offline(state->be_ctx) && !kr->active_ccache_present &&
             !kr->valid_tgt_present) ||
         (!be_is_offline(state->be_ctx) && !kr->active_ccache_present))

Should be:
     if((kr->ccname == NULL || !kr->active_ccache_present || 
(be_is_offline(be_req->be_ctx) && !kr->valid_tgt_present))

Patch 0002 review forthcoming.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list