Skip to content

Return proper tevent error in auth code #9087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
justin-stephenson wants to merge 5 commits into
base: master
Choose a base branch
from
Draft

Return proper tevent error in auth code #9087

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4eb860b
dp: Return tevent error from data provider in auth
justin-stephenson Aug 14, 2026
580c012
pam: Set PAM_PERM_DENIED for ERR_ACCESS_DENIED
justin-stephenson Aug 14, 2026
43334c7
pam: Set PAM_NEW_AUTHOK_REQD for ERR_PASSWORD_EXPIRED
justin-stephenson Aug 17, 2026
79e3ed3
pam: Set PAM_AUTHINFO_UNAVAIL for ETIMEDOUT/ERR_NETWORK_IO
justin-stephenson Aug 17, 2026
e8161a8
dp: Log expected offline message if dp returns ERR_OFFLINE
justin-stephenson Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions src/providers/ad/ad_access.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -494,8 +494,11 @@ ad_pam_access_handler_send(TALLOC_CTX *mem_ctx,
return req;

immediately:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (pd->pam_status != PAM_SUCCESS) {
tevent_req_error(req, EINVAL);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand Down Expand Up @@ -527,8 +530,11 @@ static void ad_pam_access_handler_done(struct tevent_req *subreq)
break;
}

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

errno_t
Expand Down
21 changes: 15 additions & 6 deletions src/providers/ad/ad_id.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,8 +519,11 @@ ad_account_info_handler_send(TALLOC_CTX *mem_ctx,
immediately:
dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand All @@ -540,9 +543,12 @@ static void ad_account_info_handler_done(struct tevent_req *subreq)
ret = ad_account_info_recv(subreq, &dp_error, &err_msg);
talloc_zfree(subreq);

/* TODO For backward compatibility we always return EOK to DP now. */
dp_reply_std_set(&state->reply, dp_error, ret, err_msg);
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

errno_t ad_account_info_handler_recv(TALLOC_CTX *mem_ctx,
Expand Down Expand Up @@ -715,8 +721,11 @@ ad_get_account_domain_send(TALLOC_CTX *mem_ctx,
immediately:
dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand Down
14 changes: 10 additions & 4 deletions src/providers/ad/ad_subdomains.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2387,8 +2387,11 @@ ad_subdomains_handler_send(TALLOC_CTX *mem_ctx,
immediately:
dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand All @@ -2406,9 +2409,12 @@ static void ad_subdomains_handler_done(struct tevent_req *subreq)
ret = ad_subdomains_refresh_recv(subreq);
talloc_zfree(subreq);

/* TODO For backward compatibility we always return EOK to DP now. */
dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

static errno_t ad_subdomains_handler_recv(TALLOC_CTX *mem_ctx,
Expand Down
8 changes: 7 additions & 1 deletion src/providers/data_provider_be.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,7 +338,13 @@ static void be_check_online_done(struct tevent_req *req)

ret = dp_req_recv_ptr(be_ctx, req, struct dp_reply_std, &reply);
talloc_zfree(req);
if (ret != EOK) {
if (ret == ERR_OFFLINE) {
if (be_ctx->last_dp_state != DP_ERR_OFFLINE) {
be_ctx->last_dp_state = DP_ERR_OFFLINE;
sss_log(SSS_LOG_INFO, "Backend is offline\n");
}
DEBUG(SSSDBG_TRACE_FUNC, "Backend is offline\n");
} else if (ret != EOK) {
reply = NULL;
goto done;
}
Expand Down
14 changes: 10 additions & 4 deletions src/providers/idp/idp_id.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -626,8 +626,11 @@ idp_account_info_handler_send(TALLOC_CTX *mem_ctx,
immediately:
dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand All @@ -647,9 +650,12 @@ static void idp_account_info_handler_done(struct tevent_req *subreq)
ret = idp_handle_acct_req_recv(subreq, &dp_error, &error_msg, NULL);
talloc_zfree(subreq);

/* TODO For backward compatibility we always return EOK to DP now. */
dp_reply_std_set(&state->reply, dp_error, ret, error_msg);
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

errno_t idp_account_info_handler_recv(TALLOC_CTX *mem_ctx,
Expand Down
7 changes: 5 additions & 2 deletions src/providers/idp/idp_online_check.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,11 @@ idp_online_check_handler_send(TALLOC_CTX *mem_ctx,

dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand Down
21 changes: 15 additions & 6 deletions src/providers/ipa/ipa_access.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -603,8 +603,11 @@ ipa_pam_access_handler_send(TALLOC_CTX *mem_ctx,
return req;

immediately:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (pd->pam_status != PAM_SUCCESS) {
tevent_req_error(req, EINVAL);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand Down Expand Up @@ -660,8 +663,11 @@ static void ipa_pam_access_handler_sdap_done(struct tevent_req *subreq)
return;

done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

static void ipa_pam_access_handler_done(struct tevent_req *subreq)
Expand Down Expand Up @@ -702,8 +708,11 @@ static void ipa_pam_access_handler_done(struct tevent_req *subreq)
state->pd->pam_status = PAM_SYSTEM_ERR;
}
done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

errno_t
Expand Down
42 changes: 30 additions & 12 deletions src/providers/ipa/ipa_auth.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,8 +235,11 @@ ipa_pam_auth_handler_send(TALLOC_CTX *mem_ctx,
return req;

immediately:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (pd->pam_status != PAM_SUCCESS) {
tevent_req_error(req, EINVAL);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand Down Expand Up @@ -303,8 +306,11 @@ static void ipa_pam_auth_handler_krb5_done(struct tevent_req *subreq)
}

done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

static void ipa_pam_auth_handler_flag_done(struct tevent_req *subreq)
Expand Down Expand Up @@ -352,8 +358,11 @@ static void ipa_pam_auth_handler_flag_done(struct tevent_req *subreq)
}

done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

static void ipa_pam_auth_handler_connect_done(struct tevent_req *subreq)
Expand Down Expand Up @@ -414,8 +423,11 @@ static void ipa_pam_auth_handler_connect_done(struct tevent_req *subreq)
return;

done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

static void ipa_pam_auth_handler_auth_done(struct tevent_req *subreq)
Expand Down Expand Up @@ -460,8 +472,11 @@ static void ipa_pam_auth_handler_auth_done(struct tevent_req *subreq)
return;

done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

static void ipa_pam_auth_handler_retry_done(struct tevent_req *subreq)
Expand All @@ -481,8 +496,11 @@ static void ipa_pam_auth_handler_retry_done(struct tevent_req *subreq)
state->pd->pam_status = PAM_SYSTEM_ERR;
}

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

errno_t
Expand Down
14 changes: 10 additions & 4 deletions src/providers/ipa/ipa_id.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1552,8 +1552,11 @@ ipa_account_info_handler_send(TALLOC_CTX *mem_ctx,
immediately:
dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand All @@ -1572,9 +1575,12 @@ static void ipa_account_info_handler_done(struct tevent_req *subreq)
ret = ipa_account_info_recv(subreq, &dp_error);
talloc_zfree(subreq);

/* TODO For backward compatibility we always return EOK to DP now. */
dp_reply_std_set(&state->reply, dp_error, ret, NULL);
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

errno_t ipa_account_info_handler_recv(TALLOC_CTX *mem_ctx,
Expand Down
21 changes: 15 additions & 6 deletions src/providers/ipa/ipa_selinux.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1463,8 +1463,11 @@ ipa_selinux_handler_send(TALLOC_CTX *mem_ctx,
return req;

immediately:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand Down Expand Up @@ -1524,8 +1527,11 @@ static void ipa_selinux_handler_get_done(struct tevent_req *subreq)
return;

done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

static void ipa_selinux_handler_done(struct tevent_req *subreq)
Expand All @@ -1551,8 +1557,11 @@ static void ipa_selinux_handler_done(struct tevent_req *subreq)
state->pd->pam_status = PAM_SUCCESS;

done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

errno_t
Expand Down
7 changes: 5 additions & 2 deletions src/providers/ipa/ipa_session.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -595,8 +595,11 @@ ipa_pam_session_handler_done(struct tevent_req *subreq)
}

done:
/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

errno_t
Expand Down
14 changes: 10 additions & 4 deletions src/providers/ipa/ipa_subdomains.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3315,8 +3315,11 @@ ipa_subdomains_handler_send(TALLOC_CTX *mem_ctx,
immediately:
dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);

/* TODO For backward compatibility we always return EOK to DP now. */
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
tevent_req_post(req, params->ev);

return req;
Expand All @@ -3338,9 +3341,12 @@ static void ipa_subdomains_handler_done(struct tevent_req *subreq)
ret, sss_strerror(ret));
}

/* TODO For backward compatibility we always return EOK to DP now. */
dp_reply_std_set(&state->reply, DP_ERR_DECIDE, ret, NULL);
tevent_req_done(req);
if (ret != EOK) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
}

static errno_t ipa_subdomains_handler_recv(TALLOC_CTX *mem_ctx,
Expand Down
Loading
Loading