[PROTON-735] SASL authentication failures appear as I/O failures

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: proton-0.8
• Fix Version/s: proton-0.15.0
• Component/s: proton-c
• Labels: close-pending
• Assignee: Andrew Stitcher
• Reporter: Ken Giusti
• Created: 30/Oct/14 20:00
• Updated: 08/Dec/16 14:36
• Resolved: 08/Dec/16 14:35

Description

Using the current SASL api, an application has to poll the pn_sasl_t object's state (pn_sasl_state()) until a terminal state is reached (STATE_PASS/FAIL).
Once the terminal state is reached, the outcome can be queried via pn_sasl_outcome.

Unfortunately, when the sasl client receives an authentication failure outcome from the sasl server, the sasl layer returns PN_ERR from its input processing code. This causes the pn_transport_push() to return a generic error.

From the application's point of view, this effectively results in the transport failing before the sasl terminal state has been reached. The application will interpret this event as a generic input failure on the transport - not the authentication failure it actually was.

Issue Links

• is related to: PROTON-574 proton-c: Messenger doesn't indicate when connection is aborted for a SASL negotation failure