[SSSD] [PATCH] Two fixes for subdomain krb5 offline auth

Jakub Hrozek jhrozek at redhat.com
Sun Sep 22 19:06:04 UTC 2013


Hi,

I was playing with different offline krb5 authentication ways today when
testing Sumit's patches and I don't think the offline authentication of
subdomain users was correct. Attached are two patches -- one is just a
better error code, the other actually makes the SSSD search for the
right user entry during krb5 offline auth.

To test the first one, pause of shutdown a trusted AD while remaining
connected to the root domain AD.
-------------- next part --------------
>From ce17fcc025652e29631d3f5d0d7f400df365171a Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 22 Sep 2013 18:24:43 +0200
Subject: [PATCH 1/2] KRB5: Return ERR_NETWORK_IO when trusted AD server can't
 be resolved

---
 src/providers/krb5/krb5_child.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 032f5020ebe4c2ab5505c6f77e52d201366e50d8..16ab4dbbbdd12650adcbfb60f856e66c0e6077a7 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -988,6 +988,7 @@ static errno_t map_krb5_error(krb5_error_code kerr)
         return ERR_NO_CREDS;
 
     case KRB5_KDC_UNREACH:
+    case KRB5_REALM_CANT_RESOLVE:
         return ERR_NETWORK_IO;
 
     case KRB5KDC_ERR_KEY_EXP:
-- 
1.8.3.1

-------------- next part --------------
>From 6ac81ef938692541a0fe35bd67513223c43dbe49 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 22 Sep 2013 20:48:10 +0200
Subject: [PATCH 2/2] KRB5: Use the correct domain when authenticating with
 cached password

---
 src/providers/krb5/krb5_auth.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index b373cb4c387706dfd897ad5ed34b712f27a5a0ce..49e8931186578034b9b446d44c405a87edca6806 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -757,8 +757,8 @@ static void krb5_auth_resolve_done(struct tevent_req *subreq)
             if (dp_opt_get_bool(kr->krb5_ctx->opts,
                                 KRB5_STORE_PASSWORD_IF_OFFLINE)) {
                 krb5_auth_cache_creds(state->kr->krb5_ctx,
-                                      state->be_ctx->domain->sysdb,
-                                      state->be_ctx->domain,
+                                      state->domain->sysdb,
+                                      state->domain,
                                       state->be_ctx->cdb,
                                       kr->pd, kr->uid,
                                       &state->pam_status, &state->dp_err);
@@ -1103,8 +1103,8 @@ static void krb5_auth_done(struct tevent_req *subreq)
         if (dp_opt_get_bool(kr->krb5_ctx->opts,
                             KRB5_STORE_PASSWORD_IF_OFFLINE)) {
             krb5_auth_cache_creds(state->kr->krb5_ctx,
-                                  state->be_ctx->domain->sysdb,
-                                  state->be_ctx->domain,
+                                  state->domain->sysdb,
+                                  state->domain,
                                   state->be_ctx->cdb,
                                   state->pd, state->kr->uid,
                                   &state->pam_status, &state->dp_err);
-- 
1.8.3.1



More information about the sssd-devel mailing list