[SSSD] [PATCH] Do not always return PAM_SYSTEM_ERR when offline krb5 fails

Simo Sorce simo at redhat.com
Thu Nov 8 19:19:57 UTC 2012


On Thu, 2012-11-08 at 20:09 +0100, Jakub Hrozek wrote:
> I noticed that if offline auth failed for any reason including
> mistyped
> password, we would always print System Error. This makes auditing the
> logs hard as it sounds like an internal error occured.
> 
> I don't like the header with a single inline function myself, but I
> didn't want to clutter util.h with that function either. And we don't
> have any shared header for that purpose at the moment..suggestions are
> welcome.
> 
Any reason why you want an inline here and not use a normal function in
util.c ?

On this topic I have been thinking fro quite a while that using pam
status internally is quite confusing.

We should probably finally define our own internal error range and start
adding errors there, then have error translators like this one used at
the edges only.

Should we open a ticket ?

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list