[SSSD] Patch to fix incorrect PAM return code when user enters invalid credentials

Stephen Gallagher sgallagh at redhat.com
Wed Sep 3 23:59:16 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/28/2014 10:00 PM, John Koelndorfer wrote:
> Hey folks,
> 
> Some quick background on this small patch I prepared. I run sssd on
> my desktop (and servers) to authenticate against a Samba 4 DC. I
> found that when I attempted to log in via KDM and misentered my
> password, I got an error about the authentication system failing.
> Similarly, `su` would return an error message I was not familar
> with: "Failure setting user credentials".
> 
> After some inspection of the sssd sources, I found that per 
> http://pubs.opengroup.org/onlinepubs/8329799/pam_sm_authenticate.htm,
>
> 
sssd's PAM module is returning the wrong error code when a user
> entered bad credentials. PAM_CRED_ERR is being returned instead of 
> PAM_AUTH_ERR.
> 
> Applying the attached patch and recompliing sssd brought back the
> more familiar "Authentication failure" when su'ing with a bad
> password. KDM also doesn't freak out when I enter an incorrect
> password.
> 
> If you have any questions about the patch, please be sure to
> include me in the reply as I'm not on the sssd-devel list.
> 
> Thanks for sssd, it has been awesome!
> 

Thanks for the patch! Unfortunately, it's a little bit overzealous.
There are several cases in here for which PAM_CRED_ERR is actually
correct.

For example, in krb5_auth.c, we return PAM_AUTH_ERR if the kerberos
request returns ERR_AUTH_FAILED, but we return PAM_CRED_ERR
specifically on kerberos returning ERR_CRED_ERR.

PAM_AUTH_ERR is intended to be returned when the server was
succesfully able to perform the authentication and explicitly
determined that the user was denied. PAM_CRED_ERR should indicate that
the password failed to validate for some other reason. According to
krb5_child.c, that can happen as a result of three return codes:

KRB5_PROG_ETYPE_NOSUPP (The client and the server don't have any
matching encryption keys)
KRB5_PREAUTH_FAILED (A one-time passwords or pkinit event failed)
KRB5KDC_ERR_PREAUTH_FAILED (The same as above, or a failure while
setting up a FAST tunnel occurred).

Are you using FAST on your setup? (The option krb5_use_fast = True)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlQHq1QACgkQeiVVYja6o6PdiQCeOkmHb/nfSg3UwZFnNtsxlhz1
U84An3C6kPthahgNc26m5RhwCJpmzY7q
=URR1
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list