[SSSD] [PATCH] KRB5: Print a verbose error message on failure reading the keytab

Jakub Hrozek jhrozek at redhat.com
Mon Apr 14 11:09:59 UTC 2014


On Fri, Apr 11, 2014 at 11:34:04AM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 04/11/2014 11:02 AM, Jakub Hrozek wrote:
> > Hi,
> > 
> > this patch prints an error message in case a keytab is missing 
> > completely to avoid confusing admins as in the case on sssd-users
> > today.
> > 
> > 
> 
> This is a pretty vital error; probably worth sending it to the syslog
> as well.

Yes, I was on the fence about syslog as well. Updated patch is attached.
-------------- next part --------------
>From 639a482461a6c74cf86d60ee65ddaac779861dbf Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 11 Apr 2014 16:56:55 +0200
Subject: [PATCH] KRB5: Print a verbose error message on failure reading the
 keytab

krb5_kt_resolve() returns 0 when a non-existent keytab is read, which
means there was no FATAL-level DEBUG message printed to the user in case
the keytab was missing completely and users had to enable more verbose
debugging to diagnose failure to start up.

This patch adds both the verbose DEBUG message as well as a syslog
message.
---
 src/util/sss_krb5.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c
index 7c0c5832cf75696fee5e190285eca3770b0f554b..a7f1bf37cf46e588473b817d795e72f81fcafb07 100644
--- a/src/util/sss_krb5.c
+++ b/src/util/sss_krb5.c
@@ -227,6 +227,12 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
     }
 
 done:
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE, "Failed to read keytab [%s]: %s\n",
+               KEYTAB_CLEAN_NAME, strerror(ret));
+        sss_log(SSS_LOG_ERR, "Failed to read keytab [%s]: %s\n",
+                KEYTAB_CLEAN_NAME, strerror(ret));
+    }
     if (keytab) krb5_kt_close(krb_ctx, keytab);
     if (krb_ctx) krb5_free_context(krb_ctx);
     if (client_princ != NULL) {
-- 
1.9.0



More information about the sssd-devel mailing list