From a53590ef89d78d3e065e0f1eb28b641c391b5a18 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Tue, 28 Aug 2018 14:47:44 +0200
Subject: [PATCH] KCM: Don't error out if creating a new ID as the first step
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need to handle the case where the nextID operation is ran, but the
secdb is totally empty, otherwise logins with sssd's krb5_child would
fail.

Resolves:
https://pagure.io/SSSD/sssd/issue/3815

Reviewed-by: Michal Židek <mzidek@redhat.com>

DOWNSTREAM: Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication fails with the KCM ccache
---
 src/responder/kcm/kcmsrv_ccache_secdb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/responder/kcm/kcmsrv_ccache_secdb.c b/src/responder/kcm/kcmsrv_ccache_secdb.c
index 0f1c037caf8c3bda6f3dca7136ed9236862ccdd7..a61d7b15be433e8308acc3dfa35d730247e2e615 100644
--- a/src/responder/kcm/kcmsrv_ccache_secdb.c
+++ b/src/responder/kcm/kcmsrv_ccache_secdb.c
@@ -595,7 +595,10 @@ static struct tevent_req *ccdb_secdb_nextid_send(TALLOC_CTX *mem_ctx,
     }
 
     ret = sss_sec_list(state, sreq, &keys, &nkeys);
-    if (ret != EOK) {
+    if (ret == ENOENT) {
+        keys = NULL;
+        nkeys = 0;
+    } else if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE,
               "Cannot list keys [%d]: %s\n",
               ret, sss_strerror(ret));
-- 
2.14.4