|
 |
ecf709 |
From 62cebc27bd0bdb2c12531203fd79f231e96eab7b Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
ecf709 |
Date: Fri, 2 Jun 2017 11:17:18 +0200
|
|
|
ecf709 |
Subject: [PATCH 166/166] IPA: Fix the PAM error code that auth code expects to
|
|
|
ecf709 |
start migration
|
|
|
ecf709 |
MIME-Version: 1.0
|
|
|
ecf709 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ecf709 |
Content-Transfer-Encoding: 8bit
|
|
|
ecf709 |
|
|
|
ecf709 |
Recent patches which adds support for PKINIT in krb5_child changed a
|
|
|
ecf709 |
return code which is used to indicate to the IPA provider that password
|
|
|
ecf709 |
migration should be tried.
|
|
|
ecf709 |
|
|
|
ecf709 |
With this patch krb5_child properly returns PAM_CRED_ERR as expected by
|
|
|
ecf709 |
the IPA provider in this case.
|
|
|
ecf709 |
|
|
|
ecf709 |
Resolves:
|
|
|
ecf709 |
https://pagure.io/SSSD/sssd/issue/3394
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Simo Sorce <simo@redhat.com>
|
|
|
ecf709 |
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
|
|
|
ecf709 |
---
|
|
|
ecf709 |
src/providers/krb5/krb5_child.c | 11 +++++++++++
|
|
|
ecf709 |
1 file changed, 11 insertions(+)
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
|
|
|
ecf709 |
index cbbc892bee0365892ac66d3654c974d325166b60..3cd8bfba76a35acd2c885ee2aac4765a6c1cc03c 100644
|
|
|
ecf709 |
--- a/src/providers/krb5/krb5_child.c
|
|
|
ecf709 |
+++ b/src/providers/krb5/krb5_child.c
|
|
|
ecf709 |
@@ -1540,6 +1540,17 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr,
|
|
|
ecf709 |
if (kerr != 0) {
|
|
|
ecf709 |
KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr);
|
|
|
ecf709 |
|
|
|
ecf709 |
+ /* Special case for IPA password migration */
|
|
|
ecf709 |
+ if (kr->pd->cmd == SSS_PAM_AUTHENTICATE
|
|
|
ecf709 |
+ && kerr == KRB5_PREAUTH_FAILED
|
|
|
ecf709 |
+ && kr->pkinit_prompting == false
|
|
|
ecf709 |
+ && kr->password_prompting == false
|
|
|
ecf709 |
+ && kr->otp == false
|
|
|
ecf709 |
+ && sss_authtok_get_type(kr->pd->authtok)
|
|
|
ecf709 |
+ == SSS_AUTHTOK_TYPE_PASSWORD) {
|
|
|
ecf709 |
+ return ERR_CREDS_INVALID;
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+
|
|
|
ecf709 |
/* If during authentication either the MIT Kerberos pkinit
|
|
|
ecf709 |
* pre-auth module is missing or no Smartcard is inserted and only
|
|
|
ecf709 |
* pkinit is available KRB5_PREAUTH_FAILED is returned.
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.9.4
|
|
|
ecf709 |
|