|
 |
b3b562 |
From 5458c241af90f0fd7e06b5aac40171da7f08d038 Mon Sep 17 00:00:00 2001
|
|
|
b3b562 |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
b3b562 |
Date: Wed, 28 Sep 2022 12:39:07 +0200
|
|
|
b3b562 |
Subject: [PATCH] ipa otptoken-sync: return error when sync fails
|
|
|
b3b562 |
|
|
|
b3b562 |
The command ipa otptoken-sync does not properly handle
|
|
|
b3b562 |
errors happening during the synchronization step.
|
|
|
b3b562 |
|
|
|
b3b562 |
- Even if an error is detected (such as invalid password
|
|
|
b3b562 |
provided), the command exits with return code = 0. An
|
|
|
b3b562 |
error message is displayed but the exit code should be 1.
|
|
|
b3b562 |
|
|
|
b3b562 |
- When an invalid token is provided, the token is not
|
|
|
b3b562 |
synchronized but the error is not reported back to the
|
|
|
b3b562 |
ipa otptoken-sync command.
|
|
|
b3b562 |
|
|
|
b3b562 |
The first issue can be fixed by raising an exception when
|
|
|
b3b562 |
the HTTP response contains an header with an error.
|
|
|
b3b562 |
The second issue is fixed by returning LDAP_INVALID_CREDENTIALS
|
|
|
b3b562 |
to ldap bind with the sync control if synchronization fails.
|
|
|
b3b562 |
|
|
|
b3b562 |
Fixes: https://pagure.io/freeipa/issue/9248
|
|
|
b3b562 |
|
|
|
b3b562 |
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
b3b562 |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
b3b562 |
---
|
|
|
b3b562 |
daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c | 3 +++
|
|
|
b3b562 |
ipaclient/plugins/otptoken.py | 13 ++++++++-----
|
|
|
b3b562 |
2 files changed, 11 insertions(+), 5 deletions(-)
|
|
|
b3b562 |
|
|
|
b3b562 |
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
|
|
|
b3b562 |
index ee5be3eba02b219f13e8771ce8ba6d510f1c397b..edf45df5957117771418f574cb1babab7ebaf0ed 100644
|
|
|
b3b562 |
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
|
|
|
b3b562 |
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
|
|
|
b3b562 |
@@ -1502,6 +1502,9 @@ static int ipapwd_pre_bind(Slapi_PBlock *pb)
|
|
|
b3b562 |
}
|
|
|
b3b562 |
}
|
|
|
b3b562 |
|
|
|
b3b562 |
+ /* Reset rc to make sure errors are reported*/
|
|
|
b3b562 |
+ rc = LDAP_INVALID_CREDENTIALS;
|
|
|
b3b562 |
+
|
|
|
b3b562 |
/* Authenticate the user. */
|
|
|
b3b562 |
ret = ipapwd_authenticate(dn, entry, credentials);
|
|
|
b3b562 |
if (ret) {
|
|
|
b3b562 |
diff --git a/ipaclient/plugins/otptoken.py b/ipaclient/plugins/otptoken.py
|
|
|
b3b562 |
index 14dee751c8f36a676c9115fbed0db1eca9ba0f1c..3f389c46be2feedf0bb7cb95bd451bf0e6fe6333 100644
|
|
|
b3b562 |
--- a/ipaclient/plugins/otptoken.py
|
|
|
b3b562 |
+++ b/ipaclient/plugins/otptoken.py
|
|
|
b3b562 |
@@ -22,6 +22,7 @@ import sys
|
|
|
b3b562 |
|
|
|
b3b562 |
from ipaclient.frontend import MethodOverride
|
|
|
b3b562 |
from ipalib import api, Str, Password, _
|
|
|
b3b562 |
+from ipalib import errors
|
|
|
b3b562 |
from ipalib.messages import add_message, ResultFormattingError
|
|
|
b3b562 |
from ipalib.plugable import Registry
|
|
|
b3b562 |
from ipalib.frontend import Local
|
|
|
b3b562 |
@@ -180,11 +181,13 @@ class otptoken_sync(Local):
|
|
|
b3b562 |
status['result'][self.header] = rsp.info().get(self.header, 'unknown')
|
|
|
b3b562 |
rsp.close()
|
|
|
b3b562 |
|
|
|
b3b562 |
+ if status['result'][self.header] != "ok":
|
|
|
b3b562 |
+ msg = {'error': 'Error contacting server!',
|
|
|
b3b562 |
+ 'invalid-credentials': 'Invalid Credentials!',
|
|
|
b3b562 |
+ }.get(status['result'][self.header], 'Unknown Error!')
|
|
|
b3b562 |
+ raise errors.ExecutionError(
|
|
|
b3b562 |
+ message=_("Unable to synchronize token: %s") % msg)
|
|
|
b3b562 |
return status
|
|
|
b3b562 |
|
|
|
b3b562 |
def output_for_cli(self, textui, result, *keys, **options):
|
|
|
b3b562 |
- textui.print_plain({
|
|
|
b3b562 |
- 'ok': 'Token synchronized.',
|
|
|
b3b562 |
- 'error': 'Error contacting server!',
|
|
|
b3b562 |
- 'invalid-credentials': 'Invalid Credentials!',
|
|
|
b3b562 |
- }.get(result['result'][self.header], 'Unknown Error!'))
|
|
|
b3b562 |
+ textui.print_plain('Token synchronized.')
|
|
|
b3b562 |
--
|
|
|
b3b562 |
2.37.3
|
|
|
b3b562 |
|