[SSSD] [PATCH] Select principal for GSSAPI authentication

Stephen Gallagher sgallagh at redhat.com
Wed Apr 20 14:40:07 UTC 2011


On Wed, 2011-03-30 at 15:41 +0200, Jan Zelený wrote:
> Stephen Gallagher <sgallagh at redhat.com> wrote:
> > If SDAP_SASL_AUTHID is specified, then ONLY this auth ID is allowable.
> > If the keytab doesn't contain it, we need to fail.
> > 
> > If SDAP_SASL_REALM is specified, then only the REALM portion is
> > mandatory (if we have no entries for this realm in the keytab, we need
> > to fail).
> 
> Yep, that's basically what I thought. In the new patch these conditions should 
> be met
> 
> > And for the code review:
> > 
> > Nack.
> > If the talloc_strdup() or talloc_asprintf() fails to create the return
> > values in select_principal_from_keytab(), this should be an ENOMEM
> > failure. We should not proceed with a value of NULL.
> 
> I suspected so. Corrected.

Nack.

You still have unchecked talloc_strdup() calls in this patch in
select_principal_from_keytab().

Otherwise I think this looks good.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110420/c9ac0345/attachment.sig>


More information about the sssd-devel mailing list