[autobackport: sssd-2-12] krb5_child: fix enterprise principal parsing in keep-alive sessions#8401
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request addresses a critical issue where enterprise principal settings were not being correctly updated during keep-alive sessions, leading to parsing inconsistencies in complex Active Directory environments. The changes ensure that the Kerberos principal and credential data are properly re-parsed and managed when backend settings change between commands. The introduction of k5c_setup in the keep-alive message handling and the detailed updates to krb5_req_update and k5c_setup functions correctly propagate these settings, fixing UPN handling in multi-domain AD environments. The code appears robust and directly resolves the described problem without introducing new issues.
sumit-bose
left a comment
sumit-bose
left a comment
There was a problem hiding this comment.
Hi,
backport matches the original version, ACK.
bye,
Sumit
When keep-alive sessions transition between command types (e.g., from SSS_PAM_PREAUTH to SSS_PAM_AUTHENTICATE), enterprise principal settings were not being updated, causing parsing inconsistencies in complex AD environments. This change ensures that when the backend sends updated enterprise principal settings for different command types, the principals are correctly re-parsed with the appropriate flags, fixing UPN handling in multi-domain AD environments. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com> Reviewed-by: Alejandro López <allopez@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit dd3cd95)
|
The pull request was accepted by @aplopez with the following PR CI status: 🟢 rpm-build:centos-stream-10-x86_64:upstream (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
sssd-bot
force-pushed
the
SSSD-sssd-backport-pr8351-to-sssd-2-12
branch
from
49c4b35 to
1928f1b
Compare
5 participants
This is an automatic backport of PR#8351 krb5_child: fix enterprise principal parsing in keep-alive sessions to branch sssd-2-12, created by @ikerexxe.
Please make sure this backport is correct.
Note
The commits were cherry-picked without conflicts.
You can push changes to this pull request
Original commits
dd3cd95 - krb5_child: fix enterprise principal parsing in keep-alive sessions
Backported commits
Original Pull Request Body
When keep-alive sessions transition between command types (e.g., from SSS_PAM_PREAUTH to SSS_PAM_AUTHENTICATE), enterprise principal settings were not being updated, causing parsing inconsistencies in complex AD environments.
This change ensures that when the backend sends updated enterprise principal settings for different command types, the principals are correctly re-parsed with the appropriate flags, fixing UPN handling in multi-domain AD environments.