[SSSD] Patch to fix incorrect PAM return code when user enters invalid credentials

John Koelndorfer jkoelndorfer at gmail.com
Tue Sep 2 13:54:58 UTC 2014


Any feedback on this?

On Thu, Aug 28, 2014 at 9:00 PM, John Koelndorfer
<jkoelndorfer at gmail.com> wrote:
> Hey folks,
>
> Some quick background on this small patch I prepared. I run sssd on my
> desktop (and servers) to authenticate against a Samba 4 DC. I found
> that when I attempted to log in via KDM and misentered my password, I
> got an error about the authentication system failing. Similarly, `su`
> would return an error message I was not familar with: "Failure setting
> user credentials".
>
> After some inspection of the sssd sources, I found that per
> http://pubs.opengroup.org/onlinepubs/8329799/pam_sm_authenticate.htm,
> sssd's PAM module is returning the wrong error code when a user
> entered bad credentials. PAM_CRED_ERR is being returned instead of
> PAM_AUTH_ERR.
>
> Applying the attached patch and recompliing sssd brought back the more
> familiar "Authentication failure" when su'ing with a bad password. KDM
> also doesn't freak out when I enter an incorrect password.
>
> If you have any questions about the patch, please be sure to include
> me in the reply as I'm not on the sssd-devel list.
>
> Thanks for sssd, it has been awesome!



More information about the sssd-devel mailing list