Possible PAM Authentication failure on iRODS 4.2.11

[iychoi]

I introduced special characters escaping in PAM passwords to go-irodsclient and gocommands after I found the code in python-irodsclient (676b1f8).

PAM authentication worked very well with iRODS >= 4.3, however, it did not work with iRODS 4.2.11.
Especially when there is a special character @ in PAM password, it failed. It worked when I disabled the escaping.

I believe python-irodsclient may have the same issue although I did not test.

The problematic line is at 497 of connection.py.

https://github.com/irods/python-irodsclient/blob/main/irods/connection.py#L497

The pamPassword parameter should be self.account.password to avoid the issue.

[d-w-moore]

@iychoi Should I be reading in this, that @ shouldn't be escaped in 4.2.11, but should be (or perhaps is indifferent to being) escaped in 4.3+ ?
Guess I need to run my testing again and possibly re-design to be more thorough.

[iychoi]

Because of the line below, iRODS 4.3.0 will not fall into the _login_pam().
https://github.com/irods/python-irodsclient/blob/main/irods/connection.py#L69

For iRODS servers < 4.3, I believe special characters ("@", "=", "&", ";") should not be escaped when using PamAuthRequest.

[d-w-moore]

Because of the line below, iRODS 4.3.0 will not fall into the _login_pam(). https://github.com/irods/python-irodsclient/blob/main/irods/connection.py#L69

For versions of iRODS >= 4.3.0 we should still get into _login_pam() via this line

For iRODS servers < 4.3, I believe special characters ("@", "=", "&", ";") should not be escaped when using PamAuthRequest.

Will look into that... thanks!

[iychoi]

Because of the line below, iRODS 4.3.0 will not fall into the _login_pam(). https://github.com/irods/python-irodsclient/blob/main/irods/connection.py#L69

For versions of iRODS >= 4.3.0 we should still get into _login_pam() via this line

I didn't know that. Then, I believe special characters should not be escaped with using PamAuthRequest regardless of iRODS server versions.
I only tested and confirmed that "@" should not be escaped. "&" and ";" may need to be escaped as they are parsed by XML parser.

[iychoi]

I confirm that all of these characters "@=&;" should not be escaped for iRODS < 4.3. I tested with an account that has all these 4 special characters in the password and it worked when they are not escaped.