Tuesday bug triage report (2022-09-05)

[Andreas Hasenack]

Hi,

On Thu, Sep 8, 2022 at 4:32 PM Sergio Durigan Junior
<sergiodj at ubuntu.com> wrote:
>
> On Thursday, September 08 2022, Lucas Kanashiro wrote:
>
> > ## https://pad.lv/1987992 - *(New)           [autofs]            - autofs:
> > Missing support of SCRAM for SASL binds
> >
> > The bug reporter proposed a patch which should be submitted upstream, I
> > asked them to do so and once it is done add a reference to that in the bug
> > so we can track.
>
> Thanks, Lucas.
>
> This was the bug I mentioned during the standup today.  I was going to
> suggest sending the patch upstream, but I'd like to take a second look
> just in case.  Either way, I agree with your feedback there.

I agree the placement of the SCRAM module is unfortunate (being in the
gssapi mit package), and it prevents someone who prefers the heimdal
gssapi plugin to install the scam plugin, but we have to think about
it a bit:
- this is moving a module from one package to another. How much of a
surprise will this be to our sasl users? Some users might be using
sasl without even knowing it
- is there a risk of someone who was using either SCRAM or any of the
GSSAPI plugins of losing access to either of them after a
dist-upgrade? If yes, this can have serious consequences (i.e., loss
of authentication and access to a service)
- the real bug is that you cannot have both the heimdal gssapi sasl
plugin and SCRAM installed at the same time, because the packages that
contain these plugins conflict with each other.