Repository navigation
TestLogin.test_6 fails (no PlainTextPAMPasswordError raised) for iRODS 4.2.12 #693
Description
Tests should be updated, but at the same time the containing script needs review. Putting this off until tests are overhauled after v3.1.0
Activity
[-]as of PR #685TestLogin.test_6 fails (no PlainTextPAMPasswordError raised) for iRODS 4.2.12[/-][+]TestLogin.test_6 fails (no PlainTextPAMPasswordError raised) for iRODS 4.2.12[/+]alanking commentedon Mar 19, 2025
This issue is discovered / introduced in #685.
d-w-moore commentedon May 8, 2025
In the future (iRODS 5)
PlainTextPAMPasswordErrorwon't be a thing anymore since all PAM logins will use TLS/SSL.And, I assume, iRODS 5 will lack support for legacy authentication.
But please check me on that, @alanking and/or @korydraughn ...
alanking commentedon May 8, 2025
In iRODS 5, TLS is enforced by the server, yes. Unfortunately, it's not able to prevent the client from sending the plaintext password without TLS enabled. You can - and, I think, should - make the client detect this situation and prevent the password being sent if TLS is not enabled.
iRODS 6 will drop support for legacy authentication, but it will continue to be supported in iRODS 5 to give clients a chance to migrate to the auth plugin framework (which PRC now uses, as I understand it). GSI and Kerberos schemes (which were not really supported in 4.3 either) have been dropped entirely in iRODS 5.
d-w-moore commentedon May 8, 2025
Ok, we'll prevent the client from attempting to send a password unencrypted