[SSSD] Patch to fix incorrect PAM return code when user enters invalid credentials

Jakub Hrozek jhrozek at redhat.com
Thu Sep 4 07:51:44 UTC 2014


On Tue, Sep 02, 2014 at 08:54:58AM -0500, John Koelndorfer wrote:
> Any feedback on this?

I'm sorry this mail was stuck in the spam queue. We've had more spam
lately in the queue than usual and I didn't see this legit e-mail among
the spam.

> 
> On Thu, Aug 28, 2014 at 9:00 PM, John Koelndorfer
> <jkoelndorfer at gmail.com> wrote:
> > Hey folks,
> >
> > Some quick background on this small patch I prepared. I run sssd on my
> > desktop (and servers) to authenticate against a Samba 4 DC. I found
> > that when I attempted to log in via KDM and misentered my password, I
> > got an error about the authentication system failing. Similarly, `su`
> > would return an error message I was not familar with: "Failure setting
> > user credentials".
> >
> > After some inspection of the sssd sources, I found that per
> > http://pubs.opengroup.org/onlinepubs/8329799/pam_sm_authenticate.htm,
> > sssd's PAM module is returning the wrong error code when a user
> > entered bad credentials. PAM_CRED_ERR is being returned instead of
> > PAM_AUTH_ERR.
> >
> > Applying the attached patch and recompliing sssd brought back the more
> > familiar "Authentication failure" when su'ing with a bad password. KDM
> > also doesn't freak out when I enter an incorrect password.
> >
> > If you have any questions about the patch, please be sure to include
> > me in the reply as I'm not on the sssd-devel list.
> >
> > Thanks for sssd, it has been awesome!
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list