[SSSD] [PATCHES] Fix password change for trusted AD users

Jakub Hrozek jhrozek at redhat.com
Mon Nov 19 21:15:48 UTC 2012


On Mon, Nov 19, 2012 at 05:53:38PM +0100, Sumit Bose wrote:
> On Mon, Nov 19, 2012 at 03:45:06PM +0100, Jakub Hrozek wrote:
> > On Wed, Nov 14, 2012 at 06:33:04PM +0100, Sumit Bose wrote:
> > > On Wed, Nov 14, 2012 at 12:03:14PM -0500, Simo Sorce wrote:
> > > > On Wed, 2012-11-14 at 17:27 +0100, Sumit Bose wrote:
> > > > > Hi,
> > > > > 
> > > > > the following three patches make password changes for trusted AD users
> > > > > work and fix https://fedorahosted.org/sssd/ticket/1615 . The most
> > > > > important fix, disabling canonicalization for the AS-REQ for the
> > > > > change
> > > > > password ticket, is in the third patch. The other two fixes issues I
> > > > > came across which might block password changes under specific
> > > > > conditions.
> > > > > 
> > > > > bye,
> > > > > Sumit
> > > > > 
> > > > > 
> > > > > 
> > > > > 
> > > > > 
> > > > > 
> > > > > 
> > > > > plain text
> > > > > document
> > > > > attachment
> > > > > (0001-Just-use-the-service-name-with-krb5_get_init_creds_p.patch)
> > > > 
> > > > Besides the discard_const() issue this looks good
> > > 
> > > ok, alternative version attached.
> > > 
> > > bye,
> > > Sumit
> > 
> > Hi,
> > I'm still seeing some compilation warnings with these patches:
> > 
> > src/providers/krb5/krb5_child.c: In function ‘changepw_child’:
> > src/providers/krb5/krb5_child.c:1117:41: warning: passing argument 8 of ‘krb5_get_init_creds_password’ discards ‘const’ qualifier from pointer target type [enabled by default]
> > In file included from ./src/util/sss_krb5.h:30:0,
> >                  from src/providers/krb5/krb5_child.c:33:
> > /usr/include/krb5/krb5.h:6686:1: note: expected ‘char *’ but argument is of type ‘const char *’
> > src/providers/krb5/krb5_child.c: In function ‘tgt_req_child’:
> > src/providers/krb5/krb5_child.c:1269:45: warning: passing argument 8 of ‘krb5_get_init_creds_password’ discards ‘const’ qualifier from pointer target type [enabled by default]
> > In file included from ./src/util/sss_krb5.h:30:0,
> >                  from src/providers/krb5/krb5_child.c:33:
> > /usr/include/krb5/krb5.h:6686:1: note: expected ‘char *’ but argument is of type ‘const char *’
> 
> This is what Simo requested in his comment. The fist version of the
> patch with discard_const() does not show this warning.
> 
> bye,
> Sumit

As discussed with Simo on IRC I'd like to include the attached patch
atop the patchset for sssd-1-9, because unlike master, the 1.9 branch
probably won't be used on systems that run krb5-1.11.
-------------- next part --------------
>From 56fb51035736d57061ef295009807e5ef70c6db0 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 19 Nov 2012 22:12:59 +0100
Subject: [PATCH] KRB5: Work around const warning for krb5 releases older than
 1.11

---
 src/providers/krb5/krb5_child.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index e2125a453ec1cbcad5ae08ef351e14ef002c4faa..cd6f7e34ad91441467570baa97fddd0e4a286c50 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -38,7 +38,7 @@
 #include "providers/krb5/krb5_utils.h"
 #include "sss_cli.h"
 
-#define SSSD_KRB5_CHANGEPW_PRINCIPAL "kadmin/changepw"
+#define SSSD_KRB5_CHANGEPW_PRINCIPAL discard_const("kadmin/changepw")
 
 struct krb5_child_ctx {
     /* opts taken from kinit */
-- 
1.8.0



More information about the sssd-devel mailing list