[SSSD] [PATCH] Do not always return PAM_SYSTEM_ERR when offline krb5 fails

Jakub Hrozek jhrozek at redhat.com
Fri Nov 9 07:58:51 UTC 2012


On Thu, Nov 08, 2012 at 02:56:02PM -0500, Stephen Gallagher wrote:
> On Thu 08 Nov 2012 02:19:57 PM EST, Simo Sorce wrote:
> >On Thu, 2012-11-08 at 20:09 +0100, Jakub Hrozek wrote:
> >>I noticed that if offline auth failed for any reason including
> >>mistyped
> >>password, we would always print System Error. This makes auditing the
> >>logs hard as it sounds like an internal error occured.
> >>
> >>I don't like the header with a single inline function myself, but I
> >>didn't want to clutter util.h with that function either. And we don't
> >>have any shared header for that purpose at the moment..suggestions are
> >>welcome.
> >>
> >Any reason why you want an inline here and not use a normal function in
> >util.c ?
> >
> >On this topic I have been thinking fro quite a while that using pam
> >status internally is quite confusing.
> >
> >We should probably finally define our own internal error range and start
> >adding errors there, then have error translators like this one used at
> >the edges only.
> >
> >Should we open a ticket ?
> >
> 
> It's been there and deferred for a long time:
> https://fedorahosted.org/sssd/ticket/453

I've bumped it up to NEEDS_TRIAGE.



More information about the sssd-devel mailing list