[autobackport: sssd-2-9] pam: apply SIDs from PAC to authentication indicators#8618
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the pam_gssapi_indicators_apply configuration option, allowing SIDs from the Kerberos PAC to be mapped to authentication indicators, and implements a new JSON-based authentication selection mechanism. While the feature set is comprehensive, the PR contains several critical issues: unresolved git conflict markers are present across multiple files (Makefile, documentation, and source code), which will break the build and tests. Furthermore, potential NULL pointer dereferences were identified in the list-processing logic within pamsrv_json.c and pamsrv_gssapi.c that must be addressed to prevent runtime crashes.
| domain->gssapi_indicators_apply : | ||
| (pam_ctx->gssapi_indicators_apply ? | ||
| pam_ctx->gssapi_indicators_apply : NULL); | ||
| if (indicators_apply != NULL && *indicators_apply[0] != '\0') { |
There was a problem hiding this comment.
Potential NULL pointer dereference. If indicators_apply is an empty list, indicators_apply[0] will be NULL, and dereferencing it will cause a crash.
if (indicators_apply != NULL && indicators_apply[0] != NULL && indicators_apply[0][0] != '\0') {
sumit-bose
force-pushed
the
SSSD-sssd-backport-pr8571-to-sssd-2-9
branch
3 times, most recently
from
fcd6f6a to
b0daeed
Compare
|
@sumit-bose, would you like to wait for #8620 and cherry-pick those patches here as well? |
Hi, I'm fine either way, but it might be easier to merge this and backport #8620 separately. bye, |
ok |
alexey-tikhonov
added
no-backport
To make ad_get_sids_from_pac() better reusable it is moved with its dependencies into ad_pac_common.c Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Tomáš Halman <thalman@redhat.com> (cherry picked from commit 3f9c415)
Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Tomáš Halman <thalman@redhat.com> (cherry picked from commit 22de4fd)
This patch reads the PAC of a Kerberos ticket while evaluating the authentication indicators of the Kerberos ticket during a pam_sss_gss request. Based on the value of the pam_gssapi_indicators_apply option the found SIDs might add additional authentication indicators to the evaluation. The primary use case is to handle SIDs added by Active Directory's Authentication Mechanism Assurance (AMA). :relnote: During the processing of the pam_sss_gss request SSSD will read the SID from the PAC of the Kerberos ticket and might add authentication indicators based on the value of the new option pam_gssapi_indicators_apply. The primary use case is to handle SIDs added by Active Directory's Authentication Mechanism Assurance (AMA). Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Tomáš Halman <thalman@redhat.com> (cherry picked from commit 1f680ed)
|
The pull request was accepted by @alexey-tikhonov with the following PR CI status: 🟢 CodeQL (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
sssd-bot
force-pushed
the
SSSD-sssd-backport-pr8571-to-sssd-2-9
branch
from
b0daeed to
9308256
Compare
5 participants
This is an automatic backport of PR#8571 pam: apply SIDs from PAC to authentication indicators to branch sssd-2-9, created by @sumit-bose.
Caution
@sumit-bose The patches did not apply cleanly. It is necessary to resolve conflicts before merging this pull request. Commits that introduced conflict are marked with
CONFLICT!.You can push changes to this pull request
Original commits
3f9c415 - ad: move ad_get_sids_from_pac() to ad_pac_common.c
22de4fd - pam: add pam_gssapi_indicators_apply option
1f680ed - pam: apply SIDs from PAC to authentication indicators
Backported commits
Conflicting Files Information (check for deleted and re-added files)
On branch SSSD-sssd-backport-pr8571-to-sssd-2-9
You are currently cherry-picking commit 1f680ed.
(fix conflicts and run "git cherry-pick --continue")
(use "git cherry-pick --skip" to skip this patch)
(use "git cherry-pick --abort" to cancel the cherry-pick operation)
Changes to be committed:
modified: src/config/SSSDConfig/sssdoptions.py
modified: src/responder/pam/pamsrv_cmd.c
modified: src/responder/pam/pamsrv_gssapi.c
Unmerged paths:
(use "git add/rm ..." as appropriate to mark resolution)
both modified: Makefile.am
deleted by us: src/responder/pam/pamsrv_json.c
both modified: src/tests/system/tests/test_ipa.py