tids prints bad error on wrong gss name

[Sam Hartman]

When the gss name specified on the command line does not match the gss name in the incoming request tids_auth_handler returns 1 without printing an error message.
The return value is treated as an errno or com_err value.

Recommendations:

* Print a specific authorization failure error
* return the appropriate errno value for authorization denied.

[Jennifer Richards (jennifer-k)]

I have a patch for this, using EACCES as the error code. It results in output like:

Auth denied for incorrect gss-name ('<email address hidden>' requested, expected '<email address hidden>').
tids_auth_cb: client '<email address hidden>' denied authorization.
Authenticate failed: Permission denied (err = 13)
tids_auth_connection: Error from gsscon_passive_authenticate(), rc = 13.
tids_handle_connection: Error authorizing TID Server connection.

If there's no objection, I'll commit this.

[Sam Hartman (hartmans)]

That makes sense to me.

[Jennifer Richards (jenny-borkbork)]

This was committed a while back (3c1e2de), closing.