From 4eb860bb4dd0bc26cacadad9d7e776ba5deb2b86 Mon Sep 17 00:00:00 2001 From: Justin Stephenson Date: Fri, 14 Aug 2026 09:29:36 -0400 Subject: [PATCH 1/5] dp: Return tevent error from data provider in auth In auth codepaths, return proper tevent req error in non-EOK/non-PAM_SUCCESS cases. Assisted-By: Claude Code (Opus 4.6) --- src/providers/ad/ad_access.c | 14 ++++++--- src/providers/ad/ad_id.c | 21 +++++++++---- src/providers/ad/ad_subdomains.c | 14 ++++++--- src/providers/idp/idp_id.c | 14 ++++++--- src/providers/idp/idp_online_check.c | 7 +++-- src/providers/ipa/ipa_access.c | 21 +++++++++---- src/providers/ipa/ipa_auth.c | 42 ++++++++++++++++++-------- src/providers/ipa/ipa_id.c | 14 ++++++--- src/providers/ipa/ipa_selinux.c | 21 +++++++++---- src/providers/ipa/ipa_session.c | 7 +++-- src/providers/ipa/ipa_subdomains.c | 14 ++++++--- src/providers/ipa/ipa_sudo.c | 16 +++++++--- src/providers/krb5/krb5_auth.c | 28 ++++++++++++----- src/providers/ldap/ldap_access.c | 14 ++++++--- src/providers/ldap/ldap_auth.c | 42 ++++++++++++++++++-------- src/providers/ldap/ldap_id.c | 14 ++++++--- src/providers/ldap/sdap_hostid.c | 14 ++++++--- src/providers/ldap/sdap_iphost.c | 14 ++++++--- src/providers/ldap/sdap_ipnetwork.c | 14 ++++++--- src/providers/ldap/sdap_online_check.c | 14 ++++++--- src/providers/ldap/sdap_sudo.c | 14 ++++++--- src/providers/proxy/proxy_auth.c | 14 ++++++--- src/providers/proxy/proxy_id.c | 1 - src/providers/simple/simple_access.c | 14 ++++++--- src/tests/cmocka/test_simple_access.c | 16 +++++----- 25 files changed, 294 insertions(+), 124 deletions(-) diff --git a/src/providers/ad/ad_access.c b/src/providers/ad/ad_access.c index 2ef88b7694c..55da55b7d45 100644 --- a/src/providers/ad/ad_access.c +++ b/src/providers/ad/ad_access.c @@ -494,8 +494,11 @@ ad_pam_access_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, EINVAL); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -527,8 +530,11 @@ static void ad_pam_access_handler_done(struct tevent_req *subreq) break; } - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ad/ad_id.c b/src/providers/ad/ad_id.c index 73cdd5994b2..d6d110fee5f 100644 --- a/src/providers/ad/ad_id.c +++ b/src/providers/ad/ad_id.c @@ -519,8 +519,11 @@ ad_account_info_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -540,9 +543,12 @@ static void ad_account_info_handler_done(struct tevent_req *subreq) ret = ad_account_info_recv(subreq, &dp_error, &err_msg); talloc_zfree(subreq); - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, err_msg); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t ad_account_info_handler_recv(TALLOC_CTX *mem_ctx, @@ -715,8 +721,11 @@ ad_get_account_domain_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c index 002346f55da..8ff1fe98ed8 100644 --- a/src/providers/ad/ad_subdomains.c +++ b/src/providers/ad/ad_subdomains.c @@ -2387,8 +2387,11 @@ ad_subdomains_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -2406,9 +2409,12 @@ static void ad_subdomains_handler_done(struct tevent_req *subreq) ret = ad_subdomains_refresh_recv(subreq); talloc_zfree(subreq); - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static errno_t ad_subdomains_handler_recv(TALLOC_CTX *mem_ctx, diff --git a/src/providers/idp/idp_id.c b/src/providers/idp/idp_id.c index 8ad85fb9217..62ab5f1fdff 100644 --- a/src/providers/idp/idp_id.c +++ b/src/providers/idp/idp_id.c @@ -626,8 +626,11 @@ idp_account_info_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -647,9 +650,12 @@ static void idp_account_info_handler_done(struct tevent_req *subreq) ret = idp_handle_acct_req_recv(subreq, &dp_error, &error_msg, NULL); talloc_zfree(subreq); - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, error_msg); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t idp_account_info_handler_recv(TALLOC_CTX *mem_ctx, diff --git a/src/providers/idp/idp_online_check.c b/src/providers/idp/idp_online_check.c index 683ed949842..dec0f8002bd 100644 --- a/src/providers/idp/idp_online_check.c +++ b/src/providers/idp/idp_online_check.c @@ -51,8 +51,11 @@ idp_online_check_handler_send(TALLOC_CTX *mem_ctx, dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c index bfa82a8c9b1..7716f643425 100644 --- a/src/providers/ipa/ipa_access.c +++ b/src/providers/ipa/ipa_access.c @@ -603,8 +603,11 @@ ipa_pam_access_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, EINVAL); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -660,8 +663,11 @@ static void ipa_pam_access_handler_sdap_done(struct tevent_req *subreq) return; done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void ipa_pam_access_handler_done(struct tevent_req *subreq) @@ -702,8 +708,11 @@ static void ipa_pam_access_handler_done(struct tevent_req *subreq) state->pd->pam_status = PAM_SYSTEM_ERR; } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ipa/ipa_auth.c b/src/providers/ipa/ipa_auth.c index 3bbee7d85a8..2fdcd449925 100644 --- a/src/providers/ipa/ipa_auth.c +++ b/src/providers/ipa/ipa_auth.c @@ -235,8 +235,11 @@ ipa_pam_auth_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, EINVAL); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -303,8 +306,11 @@ static void ipa_pam_auth_handler_krb5_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void ipa_pam_auth_handler_flag_done(struct tevent_req *subreq) @@ -352,8 +358,11 @@ static void ipa_pam_auth_handler_flag_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void ipa_pam_auth_handler_connect_done(struct tevent_req *subreq) @@ -414,8 +423,11 @@ static void ipa_pam_auth_handler_connect_done(struct tevent_req *subreq) return; done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void ipa_pam_auth_handler_auth_done(struct tevent_req *subreq) @@ -460,8 +472,11 @@ static void ipa_pam_auth_handler_auth_done(struct tevent_req *subreq) return; done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void ipa_pam_auth_handler_retry_done(struct tevent_req *subreq) @@ -481,8 +496,11 @@ static void ipa_pam_auth_handler_retry_done(struct tevent_req *subreq) state->pd->pam_status = PAM_SYSTEM_ERR; } - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c index d1a655de0c3..415b10d59c3 100644 --- a/src/providers/ipa/ipa_id.c +++ b/src/providers/ipa/ipa_id.c @@ -1552,8 +1552,11 @@ ipa_account_info_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -1572,9 +1575,12 @@ static void ipa_account_info_handler_done(struct tevent_req *subreq) ret = ipa_account_info_recv(subreq, &dp_error); talloc_zfree(subreq); - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t ipa_account_info_handler_recv(TALLOC_CTX *mem_ctx, diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c index f2db640f9e4..0b316981847 100644 --- a/src/providers/ipa/ipa_selinux.c +++ b/src/providers/ipa/ipa_selinux.c @@ -1463,8 +1463,11 @@ ipa_selinux_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -1524,8 +1527,11 @@ static void ipa_selinux_handler_get_done(struct tevent_req *subreq) return; done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void ipa_selinux_handler_done(struct tevent_req *subreq) @@ -1551,8 +1557,11 @@ static void ipa_selinux_handler_done(struct tevent_req *subreq) state->pd->pam_status = PAM_SUCCESS; done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ipa/ipa_session.c b/src/providers/ipa/ipa_session.c index 47c10b6d277..9edb40410b9 100644 --- a/src/providers/ipa/ipa_session.c +++ b/src/providers/ipa/ipa_session.c @@ -595,8 +595,11 @@ ipa_pam_session_handler_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c index 6c93c847689..ee1889898b7 100644 --- a/src/providers/ipa/ipa_subdomains.c +++ b/src/providers/ipa/ipa_subdomains.c @@ -3315,8 +3315,11 @@ ipa_subdomains_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -3338,9 +3341,12 @@ static void ipa_subdomains_handler_done(struct tevent_req *subreq) ret, sss_strerror(ret)); } - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static errno_t ipa_subdomains_handler_recv(TALLOC_CTX *mem_ctx, diff --git a/src/providers/ipa/ipa_sudo.c b/src/providers/ipa/ipa_sudo.c index 32ff1ceced1..1ca3dc53589 100644 --- a/src/providers/ipa/ipa_sudo.c +++ b/src/providers/ipa/ipa_sudo.c @@ -42,7 +42,7 @@ ipa_sudo_handler_send(TALLOC_CTX *mem_ctx, struct ipa_sudo_handler_state *state; struct tevent_req *subreq; struct tevent_req *req; - errno_t ret; + errno_t ret = EOK; req = tevent_req_create(mem_ctx, &state, struct ipa_sudo_handler_state); if (req == NULL) { @@ -82,8 +82,11 @@ ipa_sudo_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -125,9 +128,12 @@ static void ipa_sudo_handler_done(struct tevent_req *subreq) break; } - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static errno_t diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index ac02dfbd78b..933f1e62300 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -1365,8 +1365,11 @@ krb5_pam_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, EINVAL); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -1410,8 +1413,11 @@ static void krb5_pam_handler_auth_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void krb5_pam_handler_auth_retry_done(struct tevent_req *subreq) @@ -1438,8 +1444,11 @@ static void krb5_pam_handler_auth_retry_done(struct tevent_req *subreq) state->pd->pam_status = PAM_AUTH_ERR; } - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void krb5_pam_handler_access_done(struct tevent_req *subreq) @@ -1463,8 +1472,11 @@ static void krb5_pam_handler_access_done(struct tevent_req *subreq) access_allowed ? "allowed" : "denied", state->pd->user); state->pd->pam_status = access_allowed ? PAM_SUCCESS : PAM_PERM_DENIED; - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ldap/ldap_access.c b/src/providers/ldap/ldap_access.c index 4ec4702f907..4214af8471f 100644 --- a/src/providers/ldap/ldap_access.c +++ b/src/providers/ldap/ldap_access.c @@ -67,8 +67,11 @@ sdap_pam_access_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, EINVAL); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -107,8 +110,11 @@ static void sdap_pam_access_handler_done(struct tevent_req *subreq) break; } - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c index 5970d9a3d8d..32f51131413 100644 --- a/src/providers/ldap/ldap_auth.c +++ b/src/providers/ldap/ldap_auth.c @@ -1072,8 +1072,11 @@ sdap_pam_auth_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, EINVAL); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -1157,8 +1160,11 @@ static void sdap_pam_auth_handler_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t @@ -1388,8 +1394,11 @@ sdap_pam_chpass_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, EINVAL); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -1508,8 +1517,11 @@ static void sdap_pam_chpass_handler_auth_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (state->pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static int @@ -1640,8 +1652,11 @@ static void sdap_pam_chpass_handler_chpass_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void sdap_pam_chpass_handler_last_done(struct tevent_req *subreq) @@ -1664,8 +1679,11 @@ static void sdap_pam_chpass_handler_last_done(struct tevent_req *subreq) state->pd->pam_status = PAM_SUCCESS; done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c index bdde2a6c230..ab93626125e 100644 --- a/src/providers/ldap/ldap_id.c +++ b/src/providers/ldap/ldap_id.c @@ -1941,8 +1941,11 @@ sdap_account_info_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -1962,9 +1965,12 @@ static void sdap_account_info_handler_done(struct tevent_req *subreq) ret = sdap_handle_acct_req_recv(subreq, &dp_error, &error_msg, NULL); talloc_zfree(subreq); - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, error_msg); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t sdap_account_info_handler_recv(TALLOC_CTX *mem_ctx, diff --git a/src/providers/ldap/sdap_hostid.c b/src/providers/ldap/sdap_hostid.c index ae8caaddb89..4e1124fffa3 100644 --- a/src/providers/ldap/sdap_hostid.c +++ b/src/providers/ldap/sdap_hostid.c @@ -268,8 +268,11 @@ sdap_hostid_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -288,9 +291,12 @@ static void sdap_hostid_handler_done(struct tevent_req *subreq) ret = hosts_get_recv(subreq, &dp_error); talloc_zfree(subreq); - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ldap/sdap_iphost.c b/src/providers/ldap/sdap_iphost.c index 79c707b6d71..f5959b3e656 100644 --- a/src/providers/ldap/sdap_iphost.c +++ b/src/providers/ldap/sdap_iphost.c @@ -333,8 +333,11 @@ sdap_iphost_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -353,9 +356,12 @@ static void sdap_ip_host_handler_done(struct tevent_req *subreq) ret = sdap_ip_host_get_recv(subreq, &dp_error, NULL); talloc_zfree(subreq); - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ldap/sdap_ipnetwork.c b/src/providers/ldap/sdap_ipnetwork.c index b78f50b787d..69d1e9060ea 100644 --- a/src/providers/ldap/sdap_ipnetwork.c +++ b/src/providers/ldap/sdap_ipnetwork.c @@ -335,8 +335,11 @@ sdap_ipnetwork_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -356,9 +359,12 @@ sdap_ipnetwork_handler_done(struct tevent_req *subreq) ret = sdap_ipnetwork_get_recv(subreq, &dp_error, NULL); talloc_zfree(subreq); - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/ldap/sdap_online_check.c b/src/providers/ldap/sdap_online_check.c index cd26841c2f3..734b1967016 100644 --- a/src/providers/ldap/sdap_online_check.c +++ b/src/providers/ldap/sdap_online_check.c @@ -209,8 +209,11 @@ sdap_online_check_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -241,9 +244,12 @@ static void sdap_online_check_handler_done(struct tevent_req *subreq) } } - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static void sdap_online_check_subdomains_done(struct tevent_req *subreq) diff --git a/src/providers/ldap/sdap_sudo.c b/src/providers/ldap/sdap_sudo.c index 8cea919b940..2b8f7053c83 100644 --- a/src/providers/ldap/sdap_sudo.c +++ b/src/providers/ldap/sdap_sudo.c @@ -85,8 +85,11 @@ sdap_sudo_handler_send(TALLOC_CTX *mem_ctx, immediately: dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL); - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -128,9 +131,12 @@ static void sdap_sudo_handler_done(struct tevent_req *subreq) break; } - /* TODO For backward compatibility we always return EOK to DP now. */ dp_reply_std_set(&state->reply, dp_error, ret, NULL); - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } static errno_t diff --git a/src/providers/proxy/proxy_auth.c b/src/providers/proxy/proxy_auth.c index 316dacbdb75..300d6b6fb51 100644 --- a/src/providers/proxy/proxy_auth.c +++ b/src/providers/proxy/proxy_auth.c @@ -777,8 +777,11 @@ proxy_pam_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (pd->pam_status != PAM_SUCCESS) { + tevent_req_error(req, EINVAL); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -847,8 +850,11 @@ static void proxy_pam_handler_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/providers/proxy/proxy_id.c b/src/providers/proxy/proxy_id.c index b1d0c22ad13..2fcfb7c6f93 100644 --- a/src/providers/proxy/proxy_id.c +++ b/src/providers/proxy/proxy_id.c @@ -1939,7 +1939,6 @@ proxy_account_info_handler_send(TALLOC_CTX *mem_ctx, state->reply = proxy_account_info(state, id_ctx, data, params->be_ctx, params->be_ctx->domain); - /* TODO For backward compatibility we always return EOK to DP now. */ tevent_req_done(req); tevent_req_post(req, params->ev); diff --git a/src/providers/simple/simple_access.c b/src/providers/simple/simple_access.c index 49226adf22b..49c931159e9 100644 --- a/src/providers/simple/simple_access.c +++ b/src/providers/simple/simple_access.c @@ -245,8 +245,11 @@ simple_access_handler_send(TALLOC_CTX *mem_ctx, return req; immediately: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, params->ev); return req; @@ -276,8 +279,11 @@ static void simple_access_handler_done(struct tevent_req *subreq) } done: - /* TODO For backward compatibility we always return EOK to DP now. */ - tevent_req_done(req); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } } errno_t diff --git a/src/tests/cmocka/test_simple_access.c b/src/tests/cmocka/test_simple_access.c index 24d63b4d817..accb8dfce04 100644 --- a/src/tests/cmocka/test_simple_access.c +++ b/src/tests/cmocka/test_simple_access.c @@ -625,11 +625,11 @@ static void test_unparseable_allow_user(void **state) /* A user that would normally be denied access will be denied because * the access list can't be parsed */ - run_simple_access_check(simple_test_ctx, "u2@simple_test", EOK, false); + run_simple_access_check(simple_test_ctx, "u2@simple_test", ERR_DOMAIN_NOT_FOUND, false); /* A user that would normally be allowed access will be denied because * the access list can't be parsed */ - run_simple_access_check(simple_test_ctx, "u1@simple_test", EOK, false); + run_simple_access_check(simple_test_ctx, "u1@simple_test", ERR_DOMAIN_NOT_FOUND, false); } static void test_unparseable_deny_user(void **state) @@ -653,11 +653,11 @@ static void test_unparseable_deny_user(void **state) /* A user that would normally be denied access will be denied because * the access list can't be parsed */ - run_simple_access_check(simple_test_ctx, "u2@simple_test", EOK, false); + run_simple_access_check(simple_test_ctx, "u2@simple_test", ERR_DOMAIN_NOT_FOUND, false); /* A user that would normally be allowed access will be denied because * the access list can't be parsed */ - run_simple_access_check(simple_test_ctx, "u1@simple_test", EOK, false); + run_simple_access_check(simple_test_ctx, "u1@simple_test", ERR_DOMAIN_NOT_FOUND, false); } static void test_unparseable_allow_group(void **state) @@ -681,11 +681,11 @@ static void test_unparseable_allow_group(void **state) /* A group that would normally be denied access will be denied because * the access list can't be parsed */ - run_simple_access_check(simple_test_ctx, "u2@simple_test", EOK, false); + run_simple_access_check(simple_test_ctx, "u2@simple_test", ERR_DOMAIN_NOT_FOUND, false); /* A group that would normally be allowed access will be denied because * the access list can't be parsed */ - run_simple_access_check(simple_test_ctx, "u1@simple_test", EOK, false); + run_simple_access_check(simple_test_ctx, "u1@simple_test", ERR_DOMAIN_NOT_FOUND, false); } static void test_unparseable_deny_group(void **state) @@ -709,11 +709,11 @@ static void test_unparseable_deny_group(void **state) /* A group that would normally be denied access will be denied because * the access list can't be parsed */ - run_simple_access_check(simple_test_ctx, "u2@simple_test", EOK, false); + run_simple_access_check(simple_test_ctx, "u2@simple_test", ERR_DOMAIN_NOT_FOUND, false); /* A group that would normally be allowed access will be denied because * the access list can't be parsed */ - run_simple_access_check(simple_test_ctx, "u1@simple_test", EOK, false); + run_simple_access_check(simple_test_ctx, "u1@simple_test", ERR_DOMAIN_NOT_FOUND, false); } static void test_group_space(void **state) From 580c012eda5162c15ffa2291e72350a4dfb823cd Mon Sep 17 00:00:00 2001 From: Justin Stephenson Date: Fri, 14 Aug 2026 13:48:10 -0400 Subject: [PATCH 2/5] pam: Set PAM_PERM_DENIED for ERR_ACCESS_DENIED When ERR_ACCESS_DENIED is returned from the dp (like for HBAC evaluation), we need to set the correct PAM status --- src/responder/pam/pamsrv_dp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/responder/pam/pamsrv_dp.c b/src/responder/pam/pamsrv_dp.c index 616059dc2f7..52b25f85025 100644 --- a/src/responder/pam/pamsrv_dp.c +++ b/src/responder/pam/pamsrv_dp.c @@ -67,9 +67,13 @@ pam_dp_send_req_done(struct tevent_req *subreq) ret = sbus_call_dp_dp_pamHandler_recv(preq, subreq, &pam_response); talloc_zfree(subreq); if (ret != EOK) { - DEBUG(SSSDBG_CRIT_FAILURE, "PAM handler failed [%d]: %s\n", + DEBUG(SSSDBG_OP_FAILURE, "PAM handler failed [%d]: %s\n", ret, sss_strerror(ret)); - preq->pd->pam_status = PAM_SYSTEM_ERR; + if (ret == ERR_ACCESS_DENIED) { + preq->pd->pam_status = PAM_PERM_DENIED; + } else { + preq->pd->pam_status = PAM_SYSTEM_ERR; + } goto done; } From 43334c7fc6e77ee7f013a7420a8e62281d65ee3d Mon Sep 17 00:00:00 2001 From: Justin Stephenson Date: Mon, 17 Aug 2026 10:53:40 -0400 Subject: [PATCH 3/5] pam: Set PAM_NEW_AUTHOK_REQD for ERR_PASSWORD_EXPIRED --- src/responder/pam/pamsrv_dp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/responder/pam/pamsrv_dp.c b/src/responder/pam/pamsrv_dp.c index 52b25f85025..ed052c3944a 100644 --- a/src/responder/pam/pamsrv_dp.c +++ b/src/responder/pam/pamsrv_dp.c @@ -71,6 +71,8 @@ pam_dp_send_req_done(struct tevent_req *subreq) ret, sss_strerror(ret)); if (ret == ERR_ACCESS_DENIED) { preq->pd->pam_status = PAM_PERM_DENIED; + } else if (ret == ERR_PASSWORD_EXPIRED) { + preq->pd->pam_status = PAM_NEW_AUTHTOK_REQD; } else { preq->pd->pam_status = PAM_SYSTEM_ERR; } From 79e3ed3db0bad60196673ccec5e45a5bed29884b Mon Sep 17 00:00:00 2001 From: Justin Stephenson Date: Mon, 17 Aug 2026 12:12:15 -0400 Subject: [PATCH 4/5] pam: Set PAM_AUTHINFO_UNAVAIL for ETIMEDOUT/ERR_NETWORK_IO --- src/responder/pam/pamsrv_dp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/responder/pam/pamsrv_dp.c b/src/responder/pam/pamsrv_dp.c index ed052c3944a..a7dd4e08d11 100644 --- a/src/responder/pam/pamsrv_dp.c +++ b/src/responder/pam/pamsrv_dp.c @@ -73,6 +73,8 @@ pam_dp_send_req_done(struct tevent_req *subreq) preq->pd->pam_status = PAM_PERM_DENIED; } else if (ret == ERR_PASSWORD_EXPIRED) { preq->pd->pam_status = PAM_NEW_AUTHTOK_REQD; + } else if (ret == ETIMEDOUT || ret == ERR_NETWORK_IO) { + preq->pd->pam_status = PAM_AUTHINFO_UNAVAIL; } else { preq->pd->pam_status = PAM_SYSTEM_ERR; } From e8161a8c59698022536ee4a9b3ea7052524a5bbc Mon Sep 17 00:00:00 2001 From: Justin Stephenson Date: Mon, 17 Aug 2026 14:31:50 -0400 Subject: [PATCH 5/5] dp: Log expected offline message if dp returns ERR_OFFLINE System test fix for test_logging__offline_errors_are_written_to_logs_and_syslog() --- src/providers/data_provider_be.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c index a01f83531c3..162774b287f 100644 --- a/src/providers/data_provider_be.c +++ b/src/providers/data_provider_be.c @@ -338,7 +338,13 @@ static void be_check_online_done(struct tevent_req *req) ret = dp_req_recv_ptr(be_ctx, req, struct dp_reply_std, &reply); talloc_zfree(req); - if (ret != EOK) { + if (ret == ERR_OFFLINE) { + if (be_ctx->last_dp_state != DP_ERR_OFFLINE) { + be_ctx->last_dp_state = DP_ERR_OFFLINE; + sss_log(SSS_LOG_INFO, "Backend is offline\n"); + } + DEBUG(SSSDBG_TRACE_FUNC, "Backend is offline\n"); + } else if (ret != EOK) { reply = NULL; goto done; }