[SSSD] [PATCH] KRB5: Return PAM_AUTH_ERR on incorrect password (1.8 backport)
Pavel Březina
pbrezina at redhat.com
Thu Sep 20 08:04:02 UTC 2012
On 09/17/2012 08:29 PM, Jakub Hrozek wrote:
> On Fri, Sep 14, 2012 at 05:34:17PM +0200, Joschi Brauchle wrote:
>> >Hallo Jakub,
>> >
>> >I have tested the latest patch successfully.
>> >
>> >Please note that in the 2nd hunk,
>> >1) the line with "KRB5_DEBUG(1, kerr);" should also be removed to
>> >avoid duplicate debug messages and
>> >2) you could directly call "kerr_handle_error" instead of
>> >"kerr_to_status" (as kerr != 0).
>> >
>> >See current version:
>> >------------
>> >@@ -777,9 +812,7 @@ static errno_t changepw_child(int fd, struct
>> >krb5_req *kr)
>> > kr->options);
>> > if (kerr != 0) {
>> > KRB5_DEBUG(1, kerr);
>> >- if (kerr == KRB5_KDC_UNREACH) {
>> >- pam_status = PAM_AUTHINFO_UNAVAIL;
>> >- }
>> >+ pam_status = kerr_to_status(kerr);
>> > goto sendresponse;
>> > }
>> >------------
>> >
>> >But those are just minor cosmetic problems and do not affect the
>> >functionality of the patch.
>> >
>> >Best regards,
>> >Joschi Brauchle
>> >
> Thank you for the careful review, Joschi.
>
> An updated patch that fixes the two items pointed out above is attached.
Nack (nitpick).
> 0001-KRB5-Return-PAM_AUTH_ERR-on-incorrect-password.patch
>
> +static int kerr_handle_error(krb5_error_code kerr)
> +{
> + int pam_status;
> +
> + KRB5_DEBUG(1, kerr);
You should use SSSDBG macro here.
> + switch (kerr) {
> + case KRB5_KDC_UNREACH:
> + pam_status = PAM_AUTHINFO_UNAVAIL;
> + break;
> + case KRB5KDC_ERR_KEY_EXP:
> + pam_status = PAM_NEW_AUTHTOK_REQD;
> + break;
> + case KRB5KRB_AP_ERR_BAD_INTEGRITY:
> + pam_status = PAM_AUTH_ERR;
> + break;
> + case KRB5KDC_ERR_PREAUTH_FAILED:
> + pam_status = PAM_CRED_ERR;
> + break;
> + default:
> + pam_status = PAM_SYSTEM_ERR;
> + break;
> + }
> +
> + return pam_status;
> +}
More information about the sssd-devel
mailing list