<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 09/07/2012 11:44 AM, Joschi Brauchle wrote:
<blockquote cite="mid:504A167B.5030903@tum.de" type="cite">Hello,
<br>
<br>
I noticed a problem when using pam_sss (1.8.3) under OpenSUSE 12.2
+ KDE and filed a bugreport there:
<a class="moz-txt-link-freetext" href="https://bugzilla.novell.com/show_bug.cgi?id=779246">https://bugzilla.novell.com/show_bug.cgi?id=779246</a>
<br>
<br>
When a Kerberos user enters a wrong password, a KDM "Critical
error" message pops up (see link above for a screenshot).
<br>
<br>
In /var/log/messages, there is
<br>
------
<br>
Sep 7 11:34:03 test-os122 [sssd[krb5_child[1102]]]: Decrypt
integrity check
<br>
failed
<br>
Sep 7 11:34:03 test-os122 [sssd[krb5_child[1102]]]: Decrypt
integrity check
<br>
failed
<br>
Sep 7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth):
system info:
<br>
[Decrypt integrity check failed]
<br>
Sep 7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth):
authentication
<br>
failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=testuser
<br>
Sep 7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth):
received for user
<br>
testuser: 4 (System error)
<br>
------
<br>
<br>
As far as I know, "decrypt integrity fails" is the default
Kerberos error message for a wrong password. Hence, this is not a
"System error", but rather an authentication error.
<br>
<br>
When looking at the code of "krb5_child.c", it seems like the
default return code when checking the Kerberos TGT is
"PAM_SYSTEM_ERR", which also gets returned in the event of a
simply wrong password.
<br>
<br>
I guess, pam_sss should instead return "PAM_AUTH_ERR", is that
correct?
<br>
Has this been fixed in versions > 1.8.3?
<br>
<br>
Best regards,
<br>
Joschi Brauchle
<br>
<br>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
sssd-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a>
</pre>
</blockquote>
You can check the latest code here:
<a class="moz-txt-link-freetext" href="http://git.fedorahosted.org/git/sssd">http://git.fedorahosted.org/git/sssd</a><br>
If it is still not fixed please file a ticket:
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/">https://fedorahosted.org/sssd/</a><br>
<br>
Thank you for your help!<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>