>From 8bcd2646e948a1f05b279196a4e6f4350aa5d5a9 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 16 Nov 2009 13:56:57 +0100 Subject: [PATCH] Ignore shadow attributes --- server/man/sssd-ldap.5.xml | 25 +++++++++++++++++++++++++ server/providers/ldap/ldap_auth.c | 19 +++++++++++++++++++ server/providers/ldap/ldap_common.c | 3 ++- server/providers/ldap/sdap.h | 1 + 4 files changed, 47 insertions(+), 1 deletions(-) diff --git a/server/man/sssd-ldap.5.xml b/server/man/sssd-ldap.5.xml index a2aa730..c971a2c 100644 --- a/server/man/sssd-ldap.5.xml +++ b/server/man/sssd-ldap.5.xml @@ -582,6 +582,31 @@ + + ldap_ignore_shadow_attributes (boolean) + + + If set to true ignore the LDAP attributes + corresponding to the values describes in + shadow + 5 during + authentication, i.e. they are not used to evaluate + if the password is expired. + + + Default: true + + + Please note that you should only set this value to + false if there is a password change mechanism + available which can update the last changed time. + The current version of sssd + does not update the + corresponding attribute. + + + + diff --git a/server/providers/ldap/ldap_auth.c b/server/providers/ldap/ldap_auth.c index a9f03a7..114fc36 100644 --- a/server/providers/ldap/ldap_auth.c +++ b/server/providers/ldap/ldap_auth.c @@ -572,6 +572,7 @@ struct sdap_pam_chpass_state { char *password; char *new_password; struct sdap_handle *sh; + struct sdap_auth_ctx *ctx; }; static void sdap_auth4chpass_done(struct tevent_req *req); @@ -611,6 +612,7 @@ void sdap_pam_chpass_handler(struct be_req *breq) if (!state) goto done; state->breq = breq; + state->ctx = ctx; state->pd = pd; state->username = pd->user; state->password = talloc_strndup(state, @@ -661,6 +663,12 @@ static void sdap_auth4chpass_done(struct tevent_req *req) if (result == SDAP_AUTH_SUCCESS) { switch (pw_expire_type) { case PWEXPIRE_SHADOW: + if (dp_opt_get_bool(state->ctx->opts->basic, + SDAP_IGNORE_SHADOW_ATTRIBUTES)) { + DEBUG(5, ("Ignoring shadow attributes.\n")); + pw_expire_type = PWEXPIRE_NONE; + break; + } ret = check_pwexpire_shadow(pw_expire_data, time(NULL), &result); if (ret != EOK) { @@ -764,6 +772,7 @@ struct sdap_pam_auth_state { struct pam_data *pd; const char *username; struct dp_opt_blob password; + struct sdap_auth_ctx *ctx; }; static void sdap_pam_auth_done(struct tevent_req *req); @@ -798,6 +807,7 @@ void sdap_pam_auth_handler(struct be_req *breq) state->breq = breq; state->pd = pd; + state->ctx = ctx; state->username = pd->user; state->password.data = pd->authtok; state->password.length = pd->authtok_size; @@ -846,6 +856,12 @@ static void sdap_pam_auth_done(struct tevent_req *req) if (result == SDAP_AUTH_SUCCESS) { switch (pw_expire_type) { case PWEXPIRE_SHADOW: + if (dp_opt_get_bool(state->ctx->opts->basic, + SDAP_IGNORE_SHADOW_ATTRIBUTES)) { + DEBUG(5, ("Ignoring shadow attributes.\n")); + pw_expire_type = PWEXPIRE_NONE; + break; + } ret = check_pwexpire_shadow(pw_expire_data, time(NULL), &result); if (ret != EOK) { @@ -883,6 +899,9 @@ static void sdap_pam_auth_done(struct tevent_req *req) case SDAP_UNAVAIL: state->pd->pam_status = PAM_AUTHINFO_UNAVAIL; break; + case SDAP_ACCT_EXPIRED: + state->pd->pam_status = PAM_ACCT_EXPIRED; + break; case SDAP_AUTH_PW_EXPIRED: state->pd->pam_status = PAM_AUTHTOK_EXPIRED; break; diff --git a/server/providers/ldap/ldap_common.c b/server/providers/ldap/ldap_common.c index deffb4a..bec4099 100644 --- a/server/providers/ldap/ldap_common.c +++ b/server/providers/ldap/ldap_common.c @@ -54,7 +54,8 @@ struct dp_option default_basic_opts[] = { { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE }, /* use the same parm name as the krb5 module so we set it only once */ - { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING } + { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "ldap_ignore_shadow_attributes", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE } }; struct sdap_attr_map generic_attr_map[] = { diff --git a/server/providers/ldap/sdap.h b/server/providers/ldap/sdap.h index 8330bd6..ac25ae7 100644 --- a/server/providers/ldap/sdap.h +++ b/server/providers/ldap/sdap.h @@ -117,6 +117,7 @@ enum sdap_basic_opt { SDAP_KRB5_KEYTAB, SDAP_KRB5_KINIT, SDAP_KRB5_REALM, + SDAP_IGNORE_SHADOW_ATTRIBUTES, SDAP_OPTS_BASIC /* opts counter */ }; -- 1.6.2.5