[PATCH] KRB5: Do not attemtp to get a TGT after a password change using OTP

[Jakub Hrozek]

Hi,

the attached patch fixes #2271. Kindly see the patch and the commit
message for more details.

I tested password change w/o OTPs to make sure we don't regress and also
with TOTP. I tested both expired passwords and password change via PAM. HOTP
currently doesn't work because of another bug.

[Nathaniel McCallum]

The patch looks okay to me. There is however, a spelling error in the commit message:
"attemtp".

----- Original Message -----
>  Hi,
>  
>  the attached patch fixes #2271. Kindly see the patch and the commit
>  message for more details.
>  
>  I tested password change w/o OTPs to make sure we don't regress and also
>  with TOTP. I tested both expired passwords and password change via PAM. HOTP
>  currently doesn't work because of another bug.
>

[Jakub Hrozek]

On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
>  The patch looks okay to me. There is however, a spelling error in the
> commit message: "attemtp". 
Nice catch. A new patch (which only differs in the commit message) is
attached.

[Jakub Hrozek]

On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
>  On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
>  > The patch looks okay to me. There is however, a spelling error in the commit
> message: "attemtp".
>  
>  Nice catch. A new patch (which only differs in the commit message) is
>  attached. 
One more respin -- this time, if there was no ccache with this user's
principal after the chpass, we print a warning message telling the user
to log out and back in. Would you prefer if the message was printed
every time an OTP password is changed even though the user might posses
a valid TGT?

If you'd like me to build you a test package for easier testing.

[Jakub Hrozek]

On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
>  On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
>  > On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
>  > > The patch looks okay to me. There is however, a spelling error in the commit
> message: "attemtp".
>  > 
>  > Nice catch. A new patch (which only differs in the commit message) is
>  > attached.
>  
>  One more respin -- this time, if there was no ccache with this user's
>  principal after the chpass, we print a warning message telling the user
>  to log out and back in. Would you prefer if the message was printed
>  every time an OTP password is changed even though the user might posses
>  a valid TGT?
>  
>  If you'd like me to build you a test package for easier testing. 
Yet one more change, this time only in a DEBUG message. For convenience,
attached is also a version that applies cleanly on top of sssd-1-11 and
can be used to patch Fedora or RHEL7 packages.

Alexander or Nathaniel, will you have some time to review the patch
today? I'm away next week and would like to get this issue off the table
before I leave.

[Jakub Hrozek]

On Fri, 2014-03-21 at 16:00 +0100, Jakub Hrozek wrote:
>  On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
>  > On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
>  > > On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
>  > > > The patch looks okay to me. There is however, a spelling error in the
> commit message: "attemtp".
>  > > 
>  > > Nice catch. A new patch (which only differs in the commit message) is
>  > > attached.
>  > 
>  > One more respin -- this time, if there was no ccache with this user's
>  > principal after the chpass, we print a warning message telling the user
>  > to log out and back in. Would you prefer if the message was printed
>  > every time an OTP password is changed even though the user might posses
>  > a valid TGT?
>  > 
>  > If you'd like me to build you a test package for easier testing.
>  
>  Yet one more change, this time only in a DEBUG message. For convenience,
>  attached is also a version that applies cleanly on top of sssd-1-11 and
>  can be used to patch Fedora or RHEL7 packages.
>  
>  Alexander or Nathaniel, will you have some time to review the patch
>  today? I'm away next week and would like to get this issue off the table
>  before I leave. 
Here is the patch rebased on top of Sumit's recent krb5 opt patches.

Both patches for master and 1.11 are attached.

[Alexander Bokovoy]

On Sat, 22 Mar 2014, Jakub Hrozek wrote:
> On Fri, 2014-03-21 at 16:00 +0100, Jakub Hrozek wrote:
> > On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
> > > On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
> > > > On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
> > > > > The patch looks okay to me. There is however, a spelling error in the
> commit message: "attemtp".
> > > >
> > > > Nice catch. A new patch (which only differs in the commit message) is
> > > > attached.
> > >
> > > One more respin -- this time, if there was no ccache with this user's
> > > principal after the chpass, we print a warning message telling the user
> > > to log out and back in. Would you prefer if the message was printed
> > > every time an OTP password is changed even though the user might posses
> > > a valid TGT?
> > >
> > > If you'd like me to build you a test package for easier testing.
> >
> > Yet one more change, this time only in a DEBUG message. For convenience,
> > attached is also a version that applies cleanly on top of sssd-1-11 and
> > can be used to patch Fedora or RHEL7 packages.
> >
> > Alexander or Nathaniel, will you have some time to review the patch
> > today? I'm away next week and would like to get this issue off the table
> > before I leave.
>
> Here is the patch rebased on top of Sumit's recent krb5 opt patches.
>
> Both patches for master and 1.11 are attached. 
ACK.

I've tested the version for master branch. Changing password worked fine
for OTP case. Now the only change we miss is in FreeIPA code where
changing password with OTP does not work in WebUI...

-- 
/ Alexander Bokovoy

[Alexander Bokovoy]

On Sun, 23 Mar 2014, Alexander Bokovoy wrote:
> On Sat, 22 Mar 2014, Jakub Hrozek wrote:
> >
> >On Fri, 2014-03-21 at 16:00 +0100, Jakub Hrozek wrote:
> >>On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
> >>> On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
> >>> > On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
> >>> > > The patch looks okay to me. There is however, a spelling error in
> the commit message: "attemtp".
> >>> >
> >>> > Nice catch. A new patch (which only differs in the commit message) is
> >>> > attached.
> >>>
> >>> One more respin -- this time, if there was no ccache with this user's
> >>> principal after the chpass, we print a warning message telling the user
> >>> to log out and back in. Would you prefer if the message was printed
> >>> every time an OTP password is changed even though the user might posses
> >>> a valid TGT?
> >>>
> >>> If you'd like me to build you a test package for easier testing.
> >>
> >>Yet one more change, this time only in a DEBUG message. For convenience,
> >>attached is also a version that applies cleanly on top of sssd-1-11 and
> >>can be used to patch Fedora or RHEL7 packages.
> >>
> >>Alexander or Nathaniel, will you have some time to review the patch
> >>today? I'm away next week and would like to get this issue off the table
> >>before I leave.
> >
> >Here is the patch rebased on top of Sumit's recent krb5 opt patches.
> >
> >Both patches for master and 1.11 are attached.
> ACK.
>
> I've tested the version for master branch. Changing password worked fine
> for OTP case. Now the only change we miss is in FreeIPA code where
> changing password with OTP does not work in WebUI... 
BTW, for those who want to test OTP, I have updated my COPR repo based
on git master versions of SSSD and FreeIPA for Fedora 20 x86_64 (and few
outstanding patches, like this one).

http://copr.fedoraproject.org/coprs/abbra/freeipa-otp-unstable/
-- 
/ Alexander Bokovoy

[Sumit Bose]

On Sun, Mar 23, 2014 at 11:13:58PM +0200, Alexander Bokovoy wrote:
>  On Sat, 22 Mar 2014, Jakub Hrozek wrote:
>  >
>  >On Fri, 2014-03-21 at 16:00 +0100, Jakub Hrozek wrote:
>  >>On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
>  >>> On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
>  >>> > On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
>  >>> > > The patch looks okay to me. There is however, a spelling error in
> the commit message: "attemtp".
>  >>> >
>  >>> > Nice catch. A new patch (which only differs in the commit message) is
>  >>> > attached.
>  >>>
>  >>> One more respin -- this time, if there was no ccache with this user's
>  >>> principal after the chpass, we print a warning message telling the user
>  >>> to log out and back in. Would you prefer if the message was printed
>  >>> every time an OTP password is changed even though the user might posses
>  >>> a valid TGT?
>  >>>
>  >>> If you'd like me to build you a test package for easier testing.
>  >>
>  >>Yet one more change, this time only in a DEBUG message. For convenience,
>  >>attached is also a version that applies cleanly on top of sssd-1-11 and
>  >>can be used to patch Fedora or RHEL7 packages.
>  >>
>  >>Alexander or Nathaniel, will you have some time to review the patch
>  >>today? I'm away next week and would like to get this issue off the table
>  >>before I leave.
>  >
>  >Here is the patch rebased on top of Sumit's recent krb5 opt patches.
>  >
>  >Both patches for master and 1.11 are attached.
>  ACK.
>  
>  I've tested the version for master branch. Changing password worked fine
>  for OTP case. Now the only change we miss is in FreeIPA code where
>  changing password with OTP does not work in WebUI... 
Pushed to

master: 3983d81f461a4f17736a516eb595f54df4bf4336
sssd-1-11: 1c1693ee1a74f27caaef416d9dce5c14b0ad53f9

bye,
Sumit
>  
>  -- 
>  / Alexander Bokovoy
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-devel