[SSSD] [PATCH] KRB5: Only return PAM error for unreachable kpasswd when performing chpass

Jakub Hrozek jhrozek at redhat.com
Tue Aug 14 14:09:11 UTC 2012


I know this ticket is scheduled for RC2 but I suspect it is the root
cause of problems we were seeing in production and I wanted to provide a
scratch buil.

https://fedorahosted.org/sssd/ticket/1452

We always try to resolve the kpasswd server even when we're just
authenticating the user so that tools such as kpasswd work. However, we
should treat errors from this step as fatal only when actually changing
passwords.
-------------- next part --------------
>From 496f5ed588d6d7a82c8f1eb4ad5e66f795ae2b91 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 14 Aug 2012 14:12:18 +0200
Subject: [PATCH] KRB5: Only return PAM error for unreachable kpasswd when
 performing chpass

https://fedorahosted.org/sssd/ticket/1452
---
 src/providers/krb5/krb5_auth.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index e931da9651068a5b7c49cc9ac7f40215409e710f..1da1d02531b31d7f5e1204b66f37bd1d8999e69c 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -546,10 +546,12 @@ static void krb5_resolve_kpasswd_done(struct tevent_req *subreq)
 
     ret = be_resolve_server_recv(subreq, &state->kr->kpasswd_srv);
     talloc_zfree(subreq);
-    if (ret) {
+    if (ret != EOK &&
+        (state->kr->pd->cmd == SSS_PAM_CHAUTHTOK ||
+         state->kr->pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM)) {
         /* all kpasswd servers have been tried and none was found good, but the
          * kdc seems ok. Password changes are not possible but
-         * authentication. We return an PAM error here, but do not mark the
+         * authentication is. We return an PAM error here, but do not mark the
          * backend offline. */
         state->pam_status = PAM_AUTHTOK_LOCK_BUSY;
         state->dp_err = DP_ERR_OK;
-- 
1.7.11.2



More information about the sssd-devel mailing list