[SSSD] [PATCH] Check cache_credentials in sysdb_cache_auth_send()

Sumit Bose sbose at redhat.com
Thu Jan 21 15:00:03 UTC 2010


Hi,

although it might be good practice to check cache_credentials before
calling sysdb_cache_auth_send() I think it make sense to add it here,
too. E.g. if someone forgets to check before calling
sysdb_cache_auth_send() and for some reason the configuration is changed
from cache_credentials=true to false. Then we might access some old chached
passwords although it is expected that offline authentication does not
work anymore.

bye,
Sumit
-------------- next part --------------
From c9200f7b9009681f209d13b9a8c96f7dcb706fe2 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 21 Jan 2010 10:46:14 +0100
Subject: [PATCH] Check cache_credentials in sysdb_cache_auth_send()

---
 server/db/sysdb_ops.c      |    5 +++++
 server/tests/sysdb-tests.c |    9 +++++++++
 2 files changed, 14 insertions(+), 0 deletions(-)

diff --git a/server/db/sysdb_ops.c b/server/db/sysdb_ops.c
index 36b5867..469ed8d 100644
--- a/server/db/sysdb_ops.c
+++ b/server/db/sysdb_ops.c
@@ -4674,6 +4674,11 @@ struct tevent_req *sysdb_cache_auth_send(TALLOC_CTX *mem_ctx,
         return NULL;
     }
 
+    if (!domain->cache_credentials) {
+        DEBUG(3, ("Cached credentials not available.\n"));
+        return NULL;
+    }
+
     static const char *attrs[] = {SYSDB_NAME,
                                   SYSDB_CACHEDPWD,
                                   SYSDB_DISABLED,
diff --git a/server/tests/sysdb-tests.c b/server/tests/sysdb-tests.c
index 11fde6f..3cd5e7d 100644
--- a/server/tests/sysdb-tests.c
+++ b/server/tests/sysdb-tests.c
@@ -130,6 +130,15 @@ static int setup_sysdb_tests(struct sysdb_test_ctx **ctx)
         return ret;
     }
 
+    val[0] = "TRUE";
+    ret = confdb_add_param(test_ctx->confdb, true,
+                           "config/domain/LOCAL", "cache_credentials", val);
+    if (ret != EOK) {
+        fail("Could not initialize LOCAL domain");
+        talloc_free(test_ctx);
+        return ret;
+    }
+
     ret = confdb_get_domain(test_ctx->confdb, "local", &test_ctx->domain);
     if (ret != EOK) {
         fail("Could not retrieve LOCAL domain");
-- 
1.6.6



More information about the sssd-devel mailing list