>From d360526763607066d1057c395957f46780e7d34a Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 8 Oct 2013 18:25:20 +0200 Subject: [PATCH] KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD user If an expired AD user logs in, the SSSD receives KRB5KDC_ERR_CLIENT_REVOKED from the KDC. This error code was not handled by the SSSD which resulted in System Error being returned to the PAM stack. --- src/providers/krb5/krb5_auth.c | 6 ++++++ src/providers/krb5/krb5_child.c | 3 +++ 2 files changed, 9 insertions(+) diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index a4183dcaca6597c84b2b407e252b32a16f79773b..b4c205789dd2bc6afe0dba911f0303a83b826e92 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -1006,6 +1006,12 @@ static void krb5_auth_done(struct tevent_req *subreq) ret = EOK; goto done; + case ERR_ACCOUNT_EXPIRED: + state->pam_status = PAM_ACCT_EXPIRED; + state->dp_err = DP_ERR_OK; + ret = EOK; + goto done; + case ERR_NO_CREDS: state->pam_status = PAM_CRED_UNAVAIL; state->dp_err = DP_ERR_OK; diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 16ab4dbbbdd12650adcbfb60f856e66c0e6077a7..20fb76318f05733e862265e39b736219db753ca5 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -991,6 +991,9 @@ static errno_t map_krb5_error(krb5_error_code kerr) case KRB5_REALM_CANT_RESOLVE: return ERR_NETWORK_IO; + case KRB5KDC_ERR_CLIENT_REVOKED: + return ERR_ACCOUNT_EXPIRED; + case KRB5KDC_ERR_KEY_EXP: return ERR_CREDS_EXPIRED; -- 1.8.3.1