[SSSD] [PATCH] Send error message from krb5_child to backend.

Jakub Hrozek jhrozek at redhat.com
Wed Jun 12 15:51:35 UTC 2013


On Fri, May 24, 2013 at 04:52:49PM +0200, Lukas Slebodnik wrote:
> ehlo,
> 
> Commit c6872e79e8496fd075e20aec0343ade99cca725c caused that password migration
> doesn't work using sssd.
> 
> If pre authentication failed then we should send message to backend,
> so password migration could be detected.
> 
> https://fedorahosted.org/sssd/ticket/1873
> 
> Patch is attached.
> 
> LS

Hi,

sorry the review took such a long time. However, this is not the correct
approach. If you take a look at ipa_auth.c and how the migration is
performed in src/providers/ipa/ipa_auth.c:

263     if (state->pd->cmd == SSS_PAM_AUTHENTICATE &&
264         state->pd->pam_status == PAM_CRED_ERR) {
265 
266         req = get_password_migration_flag_send(state, state->ev,

The migration is attempted if the krb5_auth request returns PAM_CRED_ERR
as the PAM error. Now the PAM error is converted from an error code the
Kerberos child process sends to the krb5_auth request in
krb5_auth_done().

When a user is migrated from LDAP then the authentication would fail
with KRB5_PREAUTH_FAILED in the krb5_child process and the krb5_child
would return ERR_AUTH_FAILED (see src/providers/krb5/krb5_child.c:1201).

ERR_AUTH_FAILED is then converted in krb5_auth_done() into PAM_AUTH_ERR.

So I see two options here:
    1) change the condition in ipa_auth.c from detecting PAM_CRED_ERR to
    detecting PAM_AUTH_ERR. I don't like this because any authentication
    failure would then check the migration flag.
    2) Add a new ERR_AUTH code, maybe ERR_PREAUTH_FAILED to krb5_child,
    return that instead of ERR_AUTH_FAILED from the krb5_child and
    convert ERR_PREAUTH_FAILED into PAM_CRED_ERR in krb5_auth_done.

BTW to prove this was indeed the root cause, I tested by implementing 1)
option above:

diff --git a/src/providers/ipa/ipa_auth.c b/src/providers/ipa/ipa_auth.c
index 651196a..03576eb 100644
--- a/src/providers/ipa/ipa_auth.c
+++ b/src/providers/ipa/ipa_auth.c
@@ -261,7 +261,7 @@ static void ipa_auth_handler_done(struct tevent_req *req)
     }
 
     if (state->pd->cmd == SSS_PAM_AUTHENTICATE &&
-        state->pd->pam_status == PAM_CRED_ERR) {
+        state->pd->pam_status == PAM_AUTH_ERR) {
 
         req = get_password_migration_flag_send(state, state->ev,
                                              state->ipa_auth_ctx->sdap_id_ctx,

And the migration worked like a charm.



More information about the sssd-devel mailing list