[SSSD] [PATCH] Do not always return PAM_SYSTEM_ERR when offline krb5 fails

Stephen Gallagher sgallagh at redhat.com
Thu Nov 8 19:56:02 UTC 2012


On Thu 08 Nov 2012 02:19:57 PM EST, Simo Sorce wrote:
> On Thu, 2012-11-08 at 20:09 +0100, Jakub Hrozek wrote:
>> I noticed that if offline auth failed for any reason including
>> mistyped
>> password, we would always print System Error. This makes auditing the
>> logs hard as it sounds like an internal error occured.
>>
>> I don't like the header with a single inline function myself, but I
>> didn't want to clutter util.h with that function either. And we don't
>> have any shared header for that purpose at the moment..suggestions are
>> welcome.
>>
> Any reason why you want an inline here and not use a normal function in
> util.c ?
>
> On this topic I have been thinking fro quite a while that using pam
> status internally is quite confusing.
>
> We should probably finally define our own internal error range and start
> adding errors there, then have error translators like this one used at
> the edges only.
>
> Should we open a ticket ?
>

It's been there and deferred for a long time:
https://fedorahosted.org/sssd/ticket/453



More information about the sssd-devel mailing list