[autobackport: sssd-2-9] pac: fix issue with pac_check=no_check#8327
Conversation
There was a problem hiding this comment.
Code Review
This pull request is a backport of a fix for an issue where SSSD would incorrectly require the PAC LOGON_INFO buffer even when PAC checks were disabled via pac_check=no_check. This caused problems with PACs from MIT Kerberos KDCs. The change in src/providers/ad/ad_pac_common.c correctly skips the check for the LOGON_INFO buffer when pac_check_opts is 0, which aligns with the no_check setting. The documentation in src/man/sssd.conf.5.xml is also updated to clarify which KDCs are expected to provide the necessary PAC data for checks. The changes are correct and effectively resolve the issue.
So far SSSD expected that the PAC contains the logon_info buffer even if PAC checks are disabled with the 'no_check' option. This causes issues with PACs issues by MIT Kerberos KDCs which do not contain this buffer. This patches makes sure that the logon_info is not expected if 'no_check' is set and adds some clarifications to the man page. Resolves: SSSD#8300 Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Alejandro López <allopez@redhat.com> (cherry picked from commit c123201)
|
The pull request was accepted by @alexey-tikhonov with the following PR CI status: 🟢 CodeQL (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
b2bd848 to
c3dc404
Compare
This is an automatic backport of PR#8318 pac: fix issue with pac_check=no_check to branch sssd-2-9, created by @sumit-bose.
Please make sure this backport is correct.
Note
The commits were cherry-picked without conflicts.
You can push changes to this pull request
Original commits
c123201 - pac: fix issue with pac_check=no_check
Backported commits
Original Pull Request Body
So far SSSD expected that the PAC contains the logon_info buffer even if PAC checks are disabled with the 'no_check' option. This causes issues with PACs issues by MIT Kerberos KDCs which do not contain this buffer. This patches makes sure that the logon_info is not expected if 'no_check' is set and adds some clarifications to the man page.
Resolves: #8300