From 75a5e1c7a80eaa921cb0b0531d685c9c7ed12127 Mon Sep 17 00:00:00 2001

From: Alexey Tikhonov <atikhono@redhat.com>

Date: Mon, 14 Jun 2021 21:25:23 +0200

Subject: [PATCH 1/4] krb5_child: reduce log severity in sss_send_pac() in case

 PAC responder isn't running.

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/providers/krb5/krb5_child.c | 5 ++++-

 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c

index 713e90f83..4e55d9a37 100644

--- a/src/providers/krb5/krb5_child.c

+++ b/src/providers/krb5/krb5_child.c

@@ -223,7 +223,10 @@ static errno_t sss_send_pac(krb5_authdata **pac_authdata)

     ret = sss_pac_make_request(SSS_PAC_ADD_PAC_USER, &sss_data,

                                NULL, NULL, &errnop);

-    if (ret != NSS_STATUS_SUCCESS || errnop != 0) {

+    if (ret == NSS_STATUS_UNAVAIL) {

+        DEBUG(SSSDBG_MINOR_FAILURE, "failed to contact PAC responder\n");

+        return EIO;

+    } else if (ret != NSS_STATUS_SUCCESS || errnop != 0) {

         DEBUG(SSSDBG_OP_FAILURE, "sss_pac_make_request failed [%d][%d].\n",

                                   ret, errnop);

         return EIO;

-- 

2.26.3

From 9cfcbe6edc451d7187e0a89a6a5bd7125a10f1c8 Mon Sep 17 00:00:00 2001

From: Alexey Tikhonov <atikhono@redhat.com>

Date: Mon, 14 Jun 2021 21:47:52 +0200

Subject: [PATCH 2/4] secrets: reduce log severity in local_db_create() in case

 entry already exists since this is expected during normal oprations.

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/util/secrets/secrets.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/util/secrets/secrets.c b/src/util/secrets/secrets.c

index 6e99e291d..f12b615f8 100644

--- a/src/util/secrets/secrets.c

+++ b/src/util/secrets/secrets.c

@@ -476,7 +476,7 @@ static int local_db_create(struct sss_sec_req *req)

     ret = ldb_add(req->sctx->ldb, msg);

     if (ret != LDB_SUCCESS) {

         if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {

-            DEBUG(SSSDBG_OP_FAILURE,

+            DEBUG(SSSDBG_FUNC_DATA,

                   "Secret %s already exists\n", ldb_dn_get_linearized(msg->dn));

         } else {

             DEBUG(SSSDBG_CRIT_FAILURE,

-- 

2.26.3

From 32a1fbfb262ea9657fa268f7ce09ef6e942b0829 Mon Sep 17 00:00:00 2001

From: Alexey Tikhonov <atikhono@redhat.com>

Date: Mon, 14 Jun 2021 21:56:16 +0200

Subject: [PATCH 3/4] KCM: use SSSDBG_MINOR_FAILURE for

 ERR_KCM_OP_NOT_IMPLEMENTED

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/responder/kcm/kcmsrv_cmd.c | 13 +++++++++----

 src/responder/kcm/kcmsrv_ops.c |  2 +-

 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/responder/kcm/kcmsrv_cmd.c b/src/responder/kcm/kcmsrv_cmd.c

index 3ad17ef43..49518920b 100644

--- a/src/responder/kcm/kcmsrv_cmd.c

+++ b/src/responder/kcm/kcmsrv_cmd.c

@@ -195,7 +195,7 @@ static errno_t kcm_input_parse(struct kcm_reqbuf *reqbuf,

     op_io->op = kcm_get_opt(be16toh(opcode_be));

     if (op_io->op == NULL) {

-        DEBUG(SSSDBG_CRIT_FAILURE,

+        DEBUG(SSSDBG_MINOR_FAILURE,

               "Did not find a KCM operation handler for the requested opcode\n");

         return ERR_KCM_OP_NOT_IMPLEMENTED;

     }

@@ -312,7 +312,8 @@ static void kcm_reply_error(struct cli_ctx *cctx,

     errno_t ret;

     krb5_error_code kerr;

-    DEBUG(SSSDBG_OP_FAILURE,

+    DEBUG(retcode == ERR_KCM_OP_NOT_IMPLEMENTED ?

+              SSSDBG_MINOR_FAILURE : SSSDBG_OP_FAILURE,

           "KCM operation returns failure [%d]: %s\n",

           retcode, sss_strerror(retcode));

     kerr = sss2krb5_error(retcode);

@@ -405,8 +406,12 @@ static void kcm_cmd_request_done(struct tevent_req *req)

                        &req_ctx->op_io.reply);

     talloc_free(req);

     if (ret != EOK) {

-        DEBUG(SSSDBG_OP_FAILURE,

-              "KCM operation failed [%d]: %s\n", ret, sss_strerror(ret));

+        if (ret == ERR_KCM_OP_NOT_IMPLEMENTED) {

+            DEBUG(SSSDBG_MINOR_FAILURE, "%s\n", sss_strerror(ret));

+        } else {

+            DEBUG(SSSDBG_OP_FAILURE,

+                  "KCM operation failed [%d]: %s\n", ret, sss_strerror(ret));

+        }

         kcm_reply_error(req_ctx->cctx, ret, &req_ctx->repbuf);

         return;

     }

diff --git a/src/responder/kcm/kcmsrv_ops.c b/src/responder/kcm/kcmsrv_ops.c

index a8f49cedb..f7f80d850 100644

--- a/src/responder/kcm/kcmsrv_ops.c

+++ b/src/responder/kcm/kcmsrv_ops.c

@@ -122,7 +122,7 @@ struct tevent_req *kcm_cmd_send(TALLOC_CTX *mem_ctx,

     }

     if (op->fn_send == NULL) {

-        DEBUG(SSSDBG_CRIT_FAILURE,

+        DEBUG(SSSDBG_MINOR_FAILURE,

               "KCM op %s has no handler\n", kcm_opt_name(op));

         ret = ERR_KCM_OP_NOT_IMPLEMENTED;

         goto immediate;

-- 

2.26.3

From 5ead448c859860a4eb57a529a5b85eca1815e73a Mon Sep 17 00:00:00 2001

From: Alexey Tikhonov <atikhono@redhat.com>

Date: Mon, 14 Jun 2021 22:04:21 +0200

Subject: [PATCH 4/4] KCM: reduce log severity in sec_get() in case entry not

 found

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/responder/kcm/kcmsrv_ccache_secdb.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/responder/kcm/kcmsrv_ccache_secdb.c b/src/responder/kcm/kcmsrv_ccache_secdb.c

index 6c8c35b86..4631bfea0 100644

--- a/src/responder/kcm/kcmsrv_ccache_secdb.c

+++ b/src/responder/kcm/kcmsrv_ccache_secdb.c

@@ -58,7 +58,7 @@ static errno_t sec_get(TALLOC_CTX *mem_ctx,

     ret = sss_sec_get(tmp_ctx, req, &data, &len, &datatype);

     if (ret != EOK) {

-        DEBUG(SSSDBG_OP_FAILURE,

+        DEBUG(SSSDBG_MINOR_FAILURE,

               "Cannot retrieve the secret [%d]: %s\n", ret, sss_strerror(ret));

         goto done;

     }

-- 

2.26.3