44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
From 18b98836ef8e337992f0ecb239a32b9c3cedb750 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
|
Date: Wed, 9 Dec 2020 14:07:22 +0100
|
|
Subject: [PATCH] kcm: decode base64 encoded secret on upgrade path
|
|
|
|
Previous unefficient code encoded the secret multiple times:
|
|
secret -> base64 -> masterkey -> base64
|
|
|
|
To allow smooth upgrade for already existant ccache we need to also decode
|
|
the secret if it is still in the old format (type == simple). Otherwise
|
|
users are not able to log in.
|
|
|
|
Resolves: https://github.com/SSSD/sssd/issues/5349
|
|
|
|
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
|
|
---
|
|
src/responder/kcm/kcmsrv_ccache_secdb.c | 10 ++++++++++
|
|
1 file changed, 10 insertions(+)
|
|
|
|
diff --git a/src/responder/kcm/kcmsrv_ccache_secdb.c b/src/responder/kcm/kcmsrv_ccache_secdb.c
|
|
index 726711ac4..ea5c8f9ee 100644
|
|
--- a/src/responder/kcm/kcmsrv_ccache_secdb.c
|
|
+++ b/src/responder/kcm/kcmsrv_ccache_secdb.c
|
|
@@ -59,6 +59,16 @@ static errno_t sec_get(TALLOC_CTX *mem_ctx,
|
|
goto done;
|
|
}
|
|
|
|
+ if (strcmp(datatype, "simple") == 0) {
|
|
+ /* The secret is stored in b64 encoding, we need to decode it first. */
|
|
+ data = sss_base64_decode(tmp_ctx, (const char*)data, &len);
|
|
+ if (data == NULL) {
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE, "Cannot decode secret from base64\n");
|
|
+ ret = EIO;
|
|
+ goto done;
|
|
+ }
|
|
+ }
|
|
+
|
|
buf = sss_iobuf_init_steal(tmp_ctx, data, len);
|
|
if (buf == NULL) {
|
|
DEBUG(SSSDBG_CRIT_FAILURE, "Cannot init the iobuf\n");
|
|
--
|
|
2.21.3
|
|
|