On Thu, Jan 14, 2016 at 11:03:51AM -0500, Simo Sorce wrote:
> On Thu, 2016-01-14 at 12:41 +0100, Jakub Hrozek wrote:
> > On Wed, Jan 13, 2016 at 02:56:25PM -0500, Simo Sorce wrote:
> > > subj says it all,
> > > bug:
https://fedorahosted.org/sssd/ticket/2924
> > >
> > > I have compiled and run make check|intgcheck but "not" actively
tested
> > > this patch.
> >
> > I did test the patch by crating an account in AD and then ticking the
> > "Account is disabled" box. PAM returned error code 6, which is what
I'd
> > expect.
> >
> > ACK
>
> Did the old code return the wrong error too ?
Yes, before the patch I see:
Jan 14 16:23:51 adclient.win.trust.test su[3745]: pam_sss(su-l:auth): received for user
lockuser: 13 (User account has expired)
With the patched code I see:
Jan 14 16:26:13 adclient.win.trust.test su[27524]: pam_sss(su-l:auth): received for user
lockuser: 6 (Permission denied)
> I haven't looked at the AD case only IPA when I coded it but AD and IPA
> share the krb5 provider so I guess testing either would be fine ...
Yes, the PAM error codes are exactly the same after "ipa user-disable".
OK to push now?