URL: https://github.com/SSSD/sssd/pull/204 Author: sumit-bose Title: #204: krb5: return to responder that pkinit is not available Action: opened
PR body: """ If pkinit is not available for a user but other authentication methods are SSSD should still fall back to local certificate based authentication if Smartcard credentials are provided. Resolves https://pagure.io/SSSD/sssd/issue/3343 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/204/head:pr204 git checkout pr204
From 95889af2a9a512323abd5ad60e032b2632ef0a8a Mon Sep 17 00:00:00 2001 From: Sumit Bose <[email protected]> Date: Thu, 16 Mar 2017 20:43:08 +0100 Subject: [PATCH] krb5: return to responder that pkinit is not available If pkinit is not available for a user but other authentication methods are SSSD should still fall back to local certificate based authentication if Smartcard credentials are provided. Resolves https://pagure.io/SSSD/sssd/issue/3343 --- src/providers/krb5/krb5_child.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 777a25f..a4128dd 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -42,6 +42,10 @@ #define SSSD_KRB5_CHANGEPW_PRINCIPAL "kadmin/changepw" +#define IS_SC_AUTHTOK(tok) ( \ + sss_authtok_get_type((tok)) == SSS_AUTHTOK_TYPE_SC_PIN \ + || sss_authtok_get_type((tok)) == SSS_AUTHTOK_TYPE_SC_KEYPAD) + enum k5c_fast_opt { K5C_FAST_NEVER, K5C_FAST_TRY, @@ -1529,12 +1533,17 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr, * pre-auth module is missing or no Smartcard is inserted and only * pkinit is available KRB5_PREAUTH_FAILED is returned. * ERR_NO_AUTH_METHOD_AVAILABLE is used to indicate to the - * frontend that local authentication might be tried. */ + * frontend that local authentication might be tried. + * Same is true if Smartcard credentials are given but only other + * authentication methods are available. */ if (kr->pd->cmd == SSS_PAM_AUTHENTICATE && kerr == KRB5_PREAUTH_FAILED - && kr->password_prompting == false - && kr->otp == false - && kr->pkinit_prompting == false) { + && kr->pkinit_prompting == false + && (( kr->password_prompting == false + && kr->otp == false) + || ((kr->otp == true + || kr->password_prompting == true) + && IS_SC_AUTHTOK(kr->pd->authtok))) ) { return ERR_NO_AUTH_METHOD_AVAILABLE; } return kerr;
_______________________________________________ sssd-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
