diff options
| author | Jakub Hrozek <jhrozek@redhat.com> | 2012-11-19 17:36:55 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2012-11-19 22:19:29 +0100 |
| commit | 459f70d567c211f860244f75f2878c3a446c2a38 (patch) | |
| tree | 732ce79c17d222f9a7851f2a8ceebfd0909ef353 | |
| parent | e0d861963e10c5aba79ad87f8c48b0ce1bec06ca (diff) | |
| download | sssd-459f70d567c211f860244f75f2878c3a446c2a38.tar.gz sssd-459f70d567c211f860244f75f2878c3a446c2a38.tar.bz2 sssd-459f70d567c211f860244f75f2878c3a446c2a38.zip | |
LDAP: Checking the principal should not be considered fatal
The check is too restrictive as the select_principal_from_keytab can
return something else than user requested right now.
Consider that user query for host/myserver@EXAMPLE.COM, then the
select_principal_from_keytab function will return "myserver" in primary and
"EXAMPLE.COM" in realm. So the caller needs to add logic to also break
down the principal to get rid of the host/ part. The heuristics would
simply get too complex.
select_principal_from_keytab will error out anyway if there's no
suitable principal at all.
| -rw-r--r-- | src/providers/ldap/ldap_common.c | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 07e9c5d4..516ba179 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -1038,12 +1038,16 @@ sdap_set_sasl_options(struct sdap_options *id_opts, goto done; } - if ((primary_requested && strcmp(desired_primary, sasl_primary) != 0) || - (realm_requested && strcmp(desired_realm, sasl_realm) != 0)) { - DEBUG(SSSDBG_CRIT_FAILURE, - ("Configured SASL auth ID/realm not found in keytab.\n")); - ret = ENOENT; - goto done; + if (primary_requested && strcmp(desired_primary, sasl_primary) != 0) { + DEBUG(SSSDBG_MINOR_FAILURE, + ("Configured SASL auth ID not found in keytab. " + "Requested %s, found %s\n", desired_primary, sasl_primary)); + } + + if (realm_requested && strcmp(desired_realm, sasl_realm) != 0) { + DEBUG(SSSDBG_MINOR_FAILURE, + ("Configured SASL realm not found in keytab. " + "Requested %s, found %s\n", desired_realm, sasl_realm)); } ret = dp_opt_set_string(id_opts->basic, |