[SSSD] IPA/KRB5: handle KRB5_PROG_ETYPE_NOSUPP during IPA passowrd

Sumit Bose sbose at redhat.com
Tue Mar 11 15:24:08 UTC 2014


Hi,

with MIT Kerberos 1.11 and above kinit for migrated IPA users without
Kerberos keys returns KRB5_PROG_ETYPE_NOSUPP. This patch adds it to the
list of codes which trigger the IPA password migration.

bye,
Sumit
-------------- next part --------------
From f27d09c754cbce5b81e7441b66cb521b652440a9 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 11 Mar 2014 13:16:14 +0100
Subject: [PATCH] IPA/KRB5: handle KRB5_PROG_ETYPE_NOSUPP during IPA password
 migration

Fixes https://fedorahosted.org/sssd/ticket/2279
---
 src/providers/krb5/krb5_child.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 1a677b8..1bff0e9 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -990,6 +990,10 @@ static errno_t map_krb5_error(krb5_error_code kerr)
     case KRB5KRB_AP_ERR_BAD_INTEGRITY:
         return ERR_AUTH_FAILED;
 
+    /* ERR_CREDS_INVALID is used to indicate to the IPA provider that trying
+     * password migration would make sense. All Kerberos error codes which can
+     * be seen while migrating LDAP users to IPA should be added here. */
+    case KRB5_PROG_ETYPE_NOSUPP:
     case KRB5_PREAUTH_FAILED:
     case KRB5KDC_ERR_PREAUTH_FAILED:
         return ERR_CREDS_INVALID;
-- 
1.8.3.1



More information about the sssd-devel mailing list