[SSSD] [PATCH] KRB5: Return PAM_AUTH_ERR on incorrect password (1.8 backport)

Jakub Hrozek jhrozek at redhat.com
Wed Sep 12 09:32:20 UTC 2012


On Mon, Sep 10, 2012 at 05:36:50PM +0200, Jakub Hrozek wrote:
> This is a backport of a fix for
> https://fedorahosted.org/sssd/ticket/1515 to the 1-8 branch.

Joschi Brauschle nacked this patch off-list. I'm sending another version
of the patch attached, CC-ing Joschi this time.
-------------- next part --------------
>From e19a17c530023a8507df132e3e9d493e669def6c Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 9 Sep 2012 08:56:13 -0400
Subject: [PATCH] KRB5: Return PAM_AUTH_ERR on incorrect password

https://fedorahosted.org/sssd/ticket/1515
---
 src/providers/krb5/krb5_child.c | 68 +++++++++++++++++++++++------------------
 1 file changed, 39 insertions(+), 29 deletions(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 08e525ce258e1b4bd9f529c97242b5859e65ea31..43b9579b990975d07d24f6ed479a730fa7b1dbfd 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -728,6 +728,41 @@ done:
 
 }
 
+static int kerr_handle_error(krb5_error_code kerr)
+{
+    int pam_status;
+
+    KRB5_DEBUG(1, kerr);
+    switch (kerr) {
+        case KRB5_KDC_UNREACH:
+            pam_status = PAM_AUTHINFO_UNAVAIL;
+            break;
+        case KRB5KDC_ERR_KEY_EXP:
+            pam_status = PAM_NEW_AUTHTOK_REQD;
+            break;
+        case KRB5KRB_AP_ERR_BAD_INTEGRITY:
+            pam_status = PAM_AUTH_ERR;
+            break;
+        case KRB5KDC_ERR_PREAUTH_FAILED:
+            pam_status = PAM_CRED_ERR;
+            break;
+        default:
+            pam_status = PAM_SYSTEM_ERR;
+            break;
+    }
+
+    return pam_status;
+}
+
+static int kerr_to_status(krb5_error_code kerr)
+{
+    if (kerr == 0) {
+        return PAM_SUCCESS;
+    }
+
+    return kerr_handle_error(kerr);;
+}
+
 static errno_t changepw_child(int fd, struct krb5_req *kr)
 {
     int ret;
@@ -777,9 +812,7 @@ static errno_t changepw_child(int fd, struct krb5_req *kr)
                                         kr->options);
     if (kerr != 0) {
         KRB5_DEBUG(1, kerr);
-        if (kerr == KRB5_KDC_UNREACH) {
-            pam_status = PAM_AUTHINFO_UNAVAIL;
-        }
+        pam_status = kerr_to_status(kerr);
         goto sendresponse;
     }
 
@@ -866,12 +899,7 @@ static errno_t changepw_child(int fd, struct krb5_req *kr)
     talloc_zfree(newpass_str);
     memset(kr->pd->newauthtok, 0, kr->pd->newauthtok_size);
 
-    if (kerr != 0) {
-        KRB5_DEBUG(1, kerr);
-        if (kerr == KRB5_KDC_UNREACH) {
-            pam_status = PAM_AUTHINFO_UNAVAIL;
-        }
-    }
+    pam_status = kerr_to_status(kerr);
 
 sendresponse:
     ret = sendresponse(fd, kerr, pam_status, kr);
@@ -940,22 +968,7 @@ static errno_t tgt_req_child(int fd, struct krb5_req *kr)
     talloc_zfree(pass_str);
     memset(kr->pd->authtok, 0, kr->pd->authtok_size);
 
-    if (kerr != 0) {
-        KRB5_DEBUG(1, kerr);
-        switch (kerr) {
-            case KRB5_KDC_UNREACH:
-                    pam_status = PAM_AUTHINFO_UNAVAIL;
-                    break;
-            case KRB5KDC_ERR_KEY_EXP:
-                    pam_status = PAM_NEW_AUTHTOK_REQD;
-                    break;
-            case KRB5KDC_ERR_PREAUTH_FAILED:
-                    pam_status = PAM_CRED_ERR;
-                    break;
-            default:
-                    pam_status = PAM_SYSTEM_ERR;
-        }
-    }
+    pam_status = kerr_to_status(kerr);
 
 sendresponse:
     ret = sendresponse(fd, kerr, pam_status, kr);
@@ -1029,10 +1042,7 @@ static errno_t renew_tgt_child(int fd, struct krb5_req *kr)
 
     kerr = krb5_get_renewed_creds(kr->ctx, kr->creds, kr->princ, ccache, NULL);
     if (kerr != 0) {
-        KRB5_DEBUG(1, kerr);
-        if (kerr == KRB5_KDC_UNREACH) {
-            status = PAM_AUTHINFO_UNAVAIL;
-        }
+        status = kerr_handle_error(kerr);
         goto done;
     }
 
-- 
1.7.11.4



More information about the sssd-devel mailing list