[SSSD] [PATCH] KRB5: Return PAM_AUTH_ERR on incorrect password (1.8 backport)

Joschi Brauchle joschi.brauchle at tum.de
Fri Sep 14 15:34:17 UTC 2012


Hallo Jakub,

I have tested the latest patch successfully.

Please note that in the 2nd hunk,
1) the line with "KRB5_DEBUG(1, kerr);" should also be removed to avoid 
duplicate debug messages and
2) you could directly call "kerr_handle_error" instead of 
"kerr_to_status" (as kerr != 0).

See current version:
------------
@@ -777,9 +812,7 @@ static errno_t changepw_child(int fd, struct 
krb5_req *kr)
                                          kr->options);
      if (kerr != 0) {
          KRB5_DEBUG(1, kerr);
-        if (kerr == KRB5_KDC_UNREACH) {
-            pam_status = PAM_AUTHINFO_UNAVAIL;
-        }
+        pam_status = kerr_to_status(kerr);
          goto sendresponse;
      }
------------

But those are just minor cosmetic problems and do not affect the 
functionality of the patch.

Best regards,
Joschi Brauchle


On 09/12/2012 11:32 AM, Jakub Hrozek wrote:
> On Mon, Sep 10, 2012 at 05:36:50PM +0200, Jakub Hrozek wrote:
>> This is a backport of a fix for
>> https://fedorahosted.org/sssd/ticket/1515 to the 1-8 branch.
>
> Joschi Brauschle nacked this patch off-list. I'm sending another version
> of the patch attached, CC-ing Joschi this time.
>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4607 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120914/64a26ef3/attachment.p7s>


More information about the sssd-devel mailing list