From cc9c1d62ac11538d0ab003ec08f580e634483445 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 7 Nov 2025 19:22:11 +0100 Subject: [PATCH 1/3] utils: add new error code ERR_CHECK_NEXT_AUTH_TYPE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This error code should be used if another authentication type should be checked. Resolves: https://github.com/SSSD/sssd/issues/8108 Reviewed-by: Iker Pedrosa Reviewed-by: Tomáš Halman (cherry picked from commit 7ddb51fdff85d8a6b52c53421d0fac71df7b1ba4) --- src/util/util_errors.c | 1 + src/util/util_errors.h | 1 + 2 files changed, 2 insertions(+) diff --git a/src/util/util_errors.c b/src/util/util_errors.c index a9e7cf7fdb6..2a5a1daf19d 100644 --- a/src/util/util_errors.c +++ b/src/util/util_errors.c @@ -131,6 +131,7 @@ struct err_string error_to_str[] = { { "Unsupported range type" }, /* ERR_UNSUPPORTED_RANGE_TYPE */ { "proxy_child terminated by a signal" }, /* ERR_PROXY_CHILD_SIGNAL */ { "PAC check failed" }, /* ERR_CHECK_PAC_FAILED */ + { "Check next authentication type" }, /* ERR_CHECK_NEXT_AUTH_TYPE */ /* DBUS Errors */ { "Connection was killed on demand" }, /* ERR_SBUS_KILL_CONNECTION */ diff --git a/src/util/util_errors.h b/src/util/util_errors.h index c3558a2d059..02e5bcf5005 100644 --- a/src/util/util_errors.h +++ b/src/util/util_errors.h @@ -152,6 +152,7 @@ enum sssd_errors { ERR_UNSUPPORTED_RANGE_TYPE, ERR_PROXY_CHILD_SIGNAL, ERR_CHECK_PAC_FAILED, + ERR_CHECK_NEXT_AUTH_TYPE, /* DBUS Errors */ ERR_SBUS_KILL_CONNECTION, From 12f351a638c71ce0021774d3f83d786338575702 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 7 Nov 2025 19:24:08 +0100 Subject: [PATCH 2/3] krb5_child: use ERR_CHECK_NEXT_AUTH_TYPE instead of EAGAIN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This patch used the new error code ERR_CHECK_NEXT_AUTH_TYPE while processing different authentication types instead of EAGAIN because EAGAIN might have side effects when returned to the callers. Resolves: https://github.com/SSSD/sssd/issues/8108 Reviewed-by: Iker Pedrosa Reviewed-by: Tomáš Halman (cherry picked from commit 0adc2e77833d2a6d90a18c14aea48ab0a912f252) --- src/providers/krb5/krb5_child.c | 47 +++++++++++++++++---------------- 1 file changed, 24 insertions(+), 23 deletions(-) diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 21ec3862744..2914b6acb8e 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -561,7 +561,7 @@ static krb5_error_code tokeninfo_matches(TALLOC_CTX *mem_ctx, "Unsupported authtok type %d\n", sss_authtok_get_type(auth_tok)); } - return EAGAIN; + return ERR_CHECK_NEXT_AUTH_TYPE; } static krb5_error_code answer_otp(krb5_context ctx, @@ -611,7 +611,7 @@ static krb5_error_code answer_otp(krb5_context ctx, /* Allocation errors are ignored on purpose */ DEBUG(SSSDBG_TRACE_INTERNAL, "Exit answer_otp during pre-auth.\n"); - return EAGAIN; + return ERR_CHECK_NEXT_AUTH_TYPE; } /* Find the first supported tokeninfo which matches our authtoken. */ @@ -781,14 +781,14 @@ static krb5_error_code answer_pkinit(krb5_context ctx, DEBUG(SSSDBG_MINOR_FAILURE, "Unexpected authentication token type [%s]\n", sss_authtok_type_to_str(sss_authtok_get_type(kr->pd->authtok))); - kerr = EAGAIN; + kerr = ERR_CHECK_NEXT_AUTH_TYPE; goto done; } } else { /* We only expect SSS_PAM_PREAUTH here, but also for all other * commands the graceful solution would be to let the caller * check other authentication methods as well. */ - kerr = EAGAIN; + kerr = ERR_CHECK_NEXT_AUTH_TYPE; } done: @@ -918,7 +918,7 @@ static krb5_error_code answer_idp_oauth2(krb5_context kctx, if (type != SSS_AUTHTOK_TYPE_OAUTH2) { DEBUG(SSSDBG_MINOR_FAILURE, "Unexpected authentication token type [%s]\n", sss_authtok_type_to_str(type)); - kerr = EAGAIN; + kerr = ERR_CHECK_NEXT_AUTH_TYPE; goto done; } @@ -1145,7 +1145,7 @@ static krb5_error_code answer_passkey(krb5_context kctx, if (type != SSS_AUTHTOK_TYPE_PASSKEY_REPLY) { DEBUG(SSSDBG_MINOR_FAILURE, "Unexpected authentication token type [%s]\n", sss_authtok_type_to_str(type)); - kerr = EAGAIN; + kerr = ERR_CHECK_NEXT_AUTH_TYPE; goto done; } @@ -1236,7 +1236,7 @@ static krb5_error_code answer_password(krb5_context kctx, /* For SSS_PAM_PREAUTH and the other remaining commands the caller should * continue to iterate over the available authentication methods. */ - return EAGAIN; + return ERR_CHECK_NEXT_AUTH_TYPE; } static krb5_error_code sss_krb5_responder(krb5_context ctx, @@ -1261,12 +1261,12 @@ static krb5_error_code sss_krb5_responder(krb5_context ctx, /* It is expected that the answer_*() functions only return EOK * (success) if the authentication was successful, i.e. during * SSS_PAM_AUTHENTICATE. In all other cases, e.g. during - * SSS_PAM_PREAUTH either EAGAIN should be returned to indicate - * that the other available authentication methods should be - * checked as well. Or some other error code to indicate a fatal - * error where no other methods should be tried. - * Especially if setting the answer failed neither EOK nor EAGAIN - * should be returned. */ + * SSS_PAM_PREAUTH either ERR_CHECK_NEXT_AUTH_TYPE should be + * returned to indicate that the other available authentication + * methods should be checked as well. Or some other error code to + * indicate a fatal error where no other methods should be tried. + * Especially if setting the answer failed neither EOK nor + * ERR_CHECK_NEXT_AUTH_TYPE should be returned. */ if (strcmp(question_list[c], KRB5_RESPONDER_QUESTION_PASSWORD) == 0) { kerr = answer_password(ctx, kr, rctx); @@ -1296,7 +1296,7 @@ static krb5_error_code sss_krb5_responder(krb5_context ctx, /* Continue to the next question when the given authtype cannot be * handled by the answer_* function. This allows fallback between auth * types, such as passkey -> password. */ - if (kerr == EAGAIN) { + if (kerr == ERR_CHECK_NEXT_AUTH_TYPE) { /* During pre-auth iterating over all authentication methods * is expected and no message will be displayed. */ if (kr->pd->cmd == SSS_PAM_AUTHENTICATE) { @@ -1314,17 +1314,18 @@ static krb5_error_code sss_krb5_responder(krb5_context ctx, kerr = answer_password(ctx, kr, rctx); } - /* During SSS_PAM_PREAUTH 'EAGAIN' is expected because we will run - * through all offered authentication methods and all are expect to return - * 'EAGAIN' in the positive case to indicate that the other methods should - * be checked as well. If all methods are checked we are done and should - * return success. - * In the other steps, especially SSS_PAM_AUTHENTICATE, having 'EAGAIN' at - * this stage would mean that no method feels responsible for the provided - * credentials i.e. authentication failed and we should return an error. + /* During SSS_PAM_PREAUTH 'ERR_CHECK_NEXT_AUTH_TYPE' is expected because we + * will run through all offered authentication methods and all are expect to + * return 'ERR_CHECK_NEXT_AUTH_TYPE' in the positive case to indicate that + * the other methods should be checked as well. If all methods are checked + * we are done and should return success. + * In the other steps, especially SSS_PAM_AUTHENTICATE, having + * 'ERR_CHECK_NEXT_AUTH_TYPE' at this stage would mean that no method feels + * responsible for the provided credentials i.e. authentication failed and + * we should return an error. */ if (kr->pd->cmd == SSS_PAM_PREAUTH) { - return kerr == EAGAIN ? 0 : kerr; + return kerr == ERR_CHECK_NEXT_AUTH_TYPE ? 0 : kerr; } else { return kerr; } From 8a9b1efdf1218591e6cff0b2e85fa73641fbab36 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 7 Nov 2025 19:32:24 +0100 Subject: [PATCH 3/3] krb5_child: clarify EAGAIN returned by krb5_get_init_creds_password() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reviewed-by: Iker Pedrosa Reviewed-by: Tomáš Halman (cherry picked from commit da82d1d5bd9345505aab331a05bdc92ba95650b4) --- src/providers/krb5/krb5_child.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 2914b6acb8e..0506a3527f0 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -2387,6 +2387,11 @@ static krb5_error_code get_and_save_tgt(struct krb5_req *kr, KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr); if (kerr == EAGAIN) { + /* The most probable reason for krb5_get_init_creds_password() + * to return EAGAIN is a temporary failure getaddrinfo() i.e. + * DNS currently does not work reliable. In this case it makes + * sense to return KRB5_KDC_UNREACH to tell the backend to try + * other KDCs or switch into offline mode. */ kerr = KRB5_KDC_UNREACH; }