|
 |
a53771 |
From b4f3df953015bf6d2d4c973b458f778f31615c11 Mon Sep 17 00:00:00 2001
|
|
|
a53771 |
From: Greg Hudson <ghudson@mit.edu>
|
|
|
a53771 |
Date: Tue, 11 May 2021 14:04:07 -0400
|
|
|
a53771 |
Subject: [PATCH] Fix KCM retrieval support for sssd
|
|
|
a53771 |
|
|
|
a53771 |
Commit 795ebba8c039be172ab93cd41105c73ffdba0fdb added a retrieval
|
|
|
a53771 |
handler using KCM_OP_RETRIEVE, falling back on the same error codes as
|
|
|
a53771 |
the previous KCM_OP_GET_CRED_LIST support. But sssd (as of 2.4)
|
|
|
a53771 |
returns KRB5_CC_NOSUPP instead of KRB5_CC_IO if it recognizes an
|
|
|
a53771 |
opcode but does not implement it. Add a helper function to recognize
|
|
|
a53771 |
all known unsupported-opcode error codes, and use it in kcm_retrieve()
|
|
|
a53771 |
and kcm_start_seq_get().
|
|
|
a53771 |
|
|
|
a53771 |
ticket: 8997
|
|
|
a53771 |
(cherry picked from commit da103e36e13f3c846bcddbe38dd518a21e5260a0)
|
|
|
a53771 |
(cherry picked from commit a5b2cff51808cd86fe8195e7ac074ecd25c3344d)
|
|
|
a53771 |
---
|
|
|
a53771 |
src/lib/krb5/ccache/cc_kcm.c | 18 ++++++++++++++++--
|
|
|
a53771 |
1 file changed, 16 insertions(+), 2 deletions(-)
|
|
|
a53771 |
|
|
|
a53771 |
diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
|
|
|
a53771 |
index 23fcf13ea..18505cd3d 100644
|
|
|
a53771 |
--- a/src/lib/krb5/ccache/cc_kcm.c
|
|
|
a53771 |
+++ b/src/lib/krb5/ccache/cc_kcm.c
|
|
|
a53771 |
@@ -144,6 +144,20 @@ map_tcflags(krb5_flags mitflags)
|
|
|
a53771 |
return heimflags;
|
|
|
a53771 |
}
|
|
|
a53771 |
|
|
|
a53771 |
+/*
|
|
|
a53771 |
+ * Return true if code could indicate an unsupported operation. Heimdal's KCM
|
|
|
a53771 |
+ * returns KRB5_FCC_INTERNAL. sssd's KCM daemon (as of sssd 2.4) returns
|
|
|
a53771 |
+ * KRB5_CC_NO_SUPP if it recognizes the operation but does not implement it,
|
|
|
a53771 |
+ * and KRB5_CC_IO if it doesn't recognize the operation (which is unfortunate
|
|
|
a53771 |
+ * since it could also indicate a communication failure).
|
|
|
a53771 |
+ */
|
|
|
a53771 |
+static krb5_boolean
|
|
|
a53771 |
+unsupported_op_error(krb5_error_code code)
|
|
|
a53771 |
+{
|
|
|
a53771 |
+ return code == KRB5_FCC_INTERNAL || code == KRB5_CC_IO ||
|
|
|
a53771 |
+ code == KRB5_CC_NOSUPP;
|
|
|
a53771 |
+}
|
|
|
a53771 |
+
|
|
|
a53771 |
/* Begin a request for the given opcode. If cache is non-null, supply the
|
|
|
a53771 |
* cache name as a request parameter. */
|
|
|
a53771 |
static void
|
|
|
a53771 |
@@ -841,7 +855,7 @@ kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags,
|
|
|
a53771 |
ret = cache_call(context, cache, &req;;
|
|
|
a53771 |
|
|
|
a53771 |
/* Fall back to iteration if the server does not support retrieval. */
|
|
|
a53771 |
- if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) {
|
|
|
a53771 |
+ if (unsupported_op_error(ret)) {
|
|
|
a53771 |
ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred,
|
|
|
a53771 |
cred_out);
|
|
|
a53771 |
goto cleanup;
|
|
|
a53771 |
@@ -922,7 +936,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache,
|
|
|
a53771 |
ret = kcmreq_get_cred_list(&req, &creds);
|
|
|
a53771 |
if (ret)
|
|
|
a53771 |
goto cleanup;
|
|
|
a53771 |
- } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) {
|
|
|
a53771 |
+ } else if (unsupported_op_error(ret)) {
|
|
|
a53771 |
/* Fall back to GET_CRED_UUID_LIST. */
|
|
|
a53771 |
kcmreq_free(&req;;
|
|
|
a53771 |
kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache);
|