|
 |
1bb595 |
From 100839b64390d7010bfa28552fd9381ef4366496 Mon Sep 17 00:00:00 2001
|
|
|
1bb595 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
1bb595 |
Date: Fri, 26 Jun 2020 09:48:17 +0200
|
|
|
1bb595 |
Subject: [PATCH] PAM: do not treat error for cache-only lookups as fatal
|
|
|
1bb595 |
|
|
|
1bb595 |
The original fatal error came from a time where at this place in the
|
|
|
1bb595 |
code the response form the backend was checked and an error was clearly
|
|
|
1bb595 |
fatal.
|
|
|
1bb595 |
|
|
|
1bb595 |
Now we only check if the entry is in the cache and valid. An error would
|
|
|
1bb595 |
mean that the backend is called to lookup or refresh the entry. So the
|
|
|
1bb595 |
backend can change the state of the cache and make upcoming cache
|
|
|
1bb595 |
lookups successful. So it makes sense to not only call the backend if
|
|
|
1bb595 |
ENOENT is returned but for all kind of errors.
|
|
|
1bb595 |
|
|
|
1bb595 |
Resolves https://pagure.io/SSSD/sssd/issue/4098
|
|
|
1bb595 |
|
|
|
1bb595 |
Reviewed-by: Pawel Polawski <ppolawsk@redhat.com>
|
|
|
1bb595 |
---
|
|
|
1bb595 |
src/responder/pam/pamsrv_cmd.c | 6 ++----
|
|
|
1bb595 |
1 file changed, 2 insertions(+), 4 deletions(-)
|
|
|
1bb595 |
|
|
|
1bb595 |
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
|
|
|
1bb595 |
index 1cd901f15..666131cb7 100644
|
|
|
1bb595 |
--- a/src/responder/pam/pamsrv_cmd.c
|
|
|
1bb595 |
+++ b/src/responder/pam/pamsrv_cmd.c
|
|
|
1bb595 |
@@ -1941,10 +1941,8 @@ static void pam_check_user_search_next(struct tevent_req *req)
|
|
|
1bb595 |
ret = cache_req_single_domain_recv(preq, req, &result);
|
|
|
1bb595 |
talloc_zfree(req);
|
|
|
1bb595 |
if (ret != EOK && ret != ENOENT) {
|
|
|
1bb595 |
- DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
1bb595 |
- "Fatal error, killing connection!\n");
|
|
|
1bb595 |
- talloc_zfree(preq->cctx);
|
|
|
1bb595 |
- return;
|
|
|
1bb595 |
+ DEBUG(SSSDBG_OP_FAILURE, "Cache lookup failed, trying to get fresh "
|
|
|
1bb595 |
+ "data from the backened.\n");
|
|
|
1bb595 |
}
|
|
|
1bb595 |
|
|
|
1bb595 |
DEBUG(SSSDBG_TRACE_ALL, "PAM initgroups scheme [%s].\n",
|
|
|
1bb595 |
--
|
|
|
1bb595 |
2.21.3
|
|
|
1bb595 |
|