SSSD / sssd

#677 pam password change is broken with krb5 auth
Closed: Invalid Opened by simo.

Closed: Invalid
Reopen Issue

Calling passwd from the CLI returns w/o prompting.

$ passwd
Changing password for user ssorce.
passwd: Authentication token manipulation error

raising debug level yields only this error in krb5_child.log:

(Thu Nov 11 10:35:06 2010) [[sssd[krb5_child[2347]]]] [changepw_child] (1): 604: [5][Input/output error]

Tested with sssd-1.3.0-36.fc13.i686

Initial investigation reveals that this EIO error occurs when {{{krb5_get_init_creds_password()}}} is passed a NULL {{{prompter}}} and a NULL or zero-length password.

It looks like this is happening during the SSS_PAM_CHAUTHTOK_PRELIM phase, where we explicitly set {{{prompter}}} to NULL to avoid a redundant expiration warning.

We need to identify why we have a zero-length password here.

component: SSSD => Kerberos Provider
milestone: NEEDS_TRIAGE => SSSD 1.5.0
owner: somebody => sbose

The zero-length password was sent by pam_sss because the use_first_pass option was used but there was no other module in the pam stack which put a password on the stack.

resolution: => invalid
status: new => closed

Fields changed

rhbz: => 0

Metadata Update from @simo:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 1.5.0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1719

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Lowest
defect
Kerberos Provider
1.3.0
None
0
None
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.