#3459 Allow fallback from krb5_aname_to_localname to other krb5 plugins
Closed: Fixed 3 years ago Opened 3 years ago by tlipcon.

Similar to 2788, it would be better to allow fallback to other plugins (including the built-in implementations) for the krb5_aname_to_localname API.

krb5 is a little inconsistent with how this is implemented:
- for krb5_kuserok, a KRB5_PLUGIN_NO_HANDLE return value results in fallback to the next plugin
- for krb5_aname_to_localname, a KRB5_LNAME_NOTRANS return value results in fallback.

The current implementation in sss_an2ln() is returning KRB5_PLUGIN_NO_HANDLE rather than KRB5_LNAME_NOTRANS, which means that the desired fallback is not occurring. Instead the "Supplied data not handled by this plugin" error is propagating up to the calling application.

Thank you for filing the bug. This part of code is normally handled by @sbose who is currently on vacation for some time. While it looks like the fix would be as simple as s/KRB5_PLUGIN_NO_HANDLE/KRB5_LNAME_NOTRANS /I would prefer if Sumit had a chance to weight in rather than us potentially breaking the code.

So I'm going to leave this ticket open in the 'No Milestone' limbo for a bit until @sbose has a chance to review it. I hope it's OK.

Sure, that's fine. We already implemented a workaround in our own code since we have to support back releases through early el6s.

Yes, sss_an2ln() should return KRB5_LNAME_NOTRANS. @tlipcon, it sounds that you already have a patch for this. Would you like to send it as a pull-request to https://github.com/SSSD/sssd/?

I actually don't have a patch. I just worked around it in a client application to treat KRB5_PLUGIN_NO_HANDLE return codes the same as KRB5_LNAME_NOTRANS :)

Ok, newvertheless would you like to send a pull-request for SSSD with the change or would you prefer that I prepare one?

Probably better for you to do so since I dont have any kind of test environment readily set up for sssd

Metadata Update from @sbose:
- Custom field patch adjusted to on

3 years ago

Metadata Update from @jhrozek:
- Issue close_status updated to: Fixed
- Issue set to the milestone: SSSD 1.15.4
- Issue status updated to: Closed (was: Open)

3 years ago

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.0 (was: SSSD 1.15.4)

2 years ago

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1525052

2 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4485

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.