krb5: restart krb5_child for Smartcard authentication#8629
Merged
alexey-tikhonov merged 1 commit intoSSSD:masterfrom Apr 24, 2026
Merged
krb5: restart krb5_child for Smartcard authentication#8629alexey-tikhonov merged 1 commit intoSSSD:masterfrom
alexey-tikhonov merged 1 commit intoSSSD:masterfrom
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a change to restart the krb5_child process during Smartcard authentication if a different certificate is selected by the user. The review feedback points out style inconsistencies in the new conditional block, specifically regarding indentation and the placement of logical operators, to maintain consistency with the rest of the codebase.
Member
|
#8267 will need to cherry-pick this? |
Contributor
Author
Hi, yes, this is triggered by "krb5_child: advertise authentication methods". bye, |
Contributor
|
I tested on Fedora 42 containers and I can confirm this fixes the Version: Results: |
justin-stephenson
approved these changes
Apr 23, 2026
Contributor
justin-stephenson
left a comment
justin-stephenson
left a comment
There was a problem hiding this comment.
Ack, thank you.
alexey-tikhonov
added
no-backport
Member
|
Note: Covscan is clean. |
In contrast to other authentication methods for PKINIT some information about the used Smartcard and certificate are already needed for the pre-authentication step to trigger the MIT Kerberos PKINIT module to get back the information if PKINIT is possible or not and if the Smartcard can be used for authentication. If krb5_child is kept running between the pre-authentication and the authentication step the information given during pre-authentication is used if Smartcard authentication was selected. As long as only a single certificate is available there is no issue. But if there are multiple certificates which all apply to the given mapping and matching rules for the user trying to log in and the user can choose a certificate for authentication the authentication might fail if the certificate use during pre-authentication and the one selected by the user differ. Before the change to keep krb5_child running for all authentication methods this was not an issue since the fresh instance started during the authentication step was using the certificate selected by the user. With this patch krb5_child is restart during the authentication step is Smartcard authentication was selected. Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Contributor
sssd-bot
force-pushed
the
krb5_child_sc_restart
branch
from
59f041b to
867c295
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In contrast to other authentication methods for PKINIT some information about the used Smartcard and certificate are already needed for the pre-authentication step to trigger the MIT Kerberos PKINIT module to get back the information if PKINIT is possible or not and if the Smartcard can be used for authentication. If krb5_child is kept running between the pre-authentication and the authentication step the information given during pre-authentication is used if Smartcard authentication was selected.
As long as only a single certificate is available there is no issue. But if there are multiple certificates which all apply to the given mapping and matching rules for the user trying to log in and the user can choose a certificate for authentication the authentication might fail if the certificate use during pre-authentication and the one selected by the user differ. Before the change to keep krb5_child running for all authentication methods this was not an issue since the fresh instance started during the authentication step was using the certificate selected by the user.
With this patch krb5_child is restart during the authentication step is Smartcard authentication was selected.