On Wed, Feb 22, 2017 at 11:47:10AM +0100, Christophe Fergeau wrote:
> On Wed, Feb 22, 2017 at 11:50:21AM +0200, Snir Sheriber wrote:
> > Hi,
> >
> >
> > On 02/21/2017 06:37 PM, Christophe Fergeau wrote:
> > > On Sun, Feb 19, 2017 at 04:47:17PM +0200, Snir Sheriber wrote:
> > > > Remove handling with failures in the SASL authentication
> > > > process to separate function
> > > > ---
> > > > src/spice-channel.c | 44 +++++++++++++++++++++++++++-----------------
> > > > 1 file changed, 27 insertions(+), 17 deletions(-)
> > > >
> > > > diff --git a/src/spice-channel.c b/src/spice-channel.c
> > > > index af67931..cbf1291 100644
> > > > --- a/src/spice-channel.c
> > > > +++ b/src/spice-channel.c
> > > > @@ -1113,28 +1113,38 @@ static int spice_channel_read(SpiceChannel *channel, void *data, size_t length)
> > > > return length;
> > > > }
> > > > +#if HAVE_SASL
> > > > /* coroutine context */
> > > > -static void spice_channel_failed_authentication(SpiceChannel *channel,
> > > > - gboolean invalidPassword)
> > > > +static void spice_channel_failed_sasl_authentication(SpiceChannel *channel)
> > > > {
> > > > SpiceChannelPrivate *c = channel->priv;
> > > > + gint err_code; /* Affects the authentication window activated fileds */
> > > > if (c->auth_needs_username && c->auth_needs_password)
> > > > - g_set_error_literal(&c->error,
> > > > - SPICE_CLIENT_ERROR,
> > > > - SPICE_CLIENT_ERROR_AUTH_NEEDS_PASSWORD_AND_USERNAME,
> > > > - _("Authentication failed: password and username are required"));
> > > > + err_code = SPICE_CLIENT_ERROR_AUTH_NEEDS_PASSWORD_AND_USERNAME;
> > > > else if (c->auth_needs_username)
> > > > - g_set_error_literal(&c->error,
> > > > - SPICE_CLIENT_ERROR,
> > > > - SPICE_CLIENT_ERROR_AUTH_NEEDS_USERNAME,
> > > > - _("Authentication failed: username is required"));
> > Is there a mechanism that allows only username ?
>
> I guess in SSO setups, it makes sense to first ask for just a username,
> then check for a valid kerberos ticket for that username (or whatever
> you use for SSO), and if there is no such ticket, then ask for an
> additional authentication token.
If you want to correctly use SASL then you should not make any
assumptions about which credentials you'll be asked for. Even if a
mechanism wants the username *and* password, it is permitted to
ask for them in separate steps of the handshake. So you might need
to popup a dialog to ask for username, and then later ask for
password in a new dialog popup. It is upto the mechanism plugin
to decide which to ask for at which point, so the app can not
predict that.
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel