On Thu, Jan 14, 2016 at 11:03:51AM -0500, Simo Sorce wrote:
On Thu, 2016-01-14 at 12:41 +0100, Jakub Hrozek wrote:
> On Wed, Jan 13, 2016 at 02:56:25PM -0500, Simo Sorce wrote:
> > subj says it all,
> > bug:
https://fedorahosted.org/sssd/ticket/2924
> >
> > I have compiled and run make check|intgcheck but "not" actively
tested
> > this patch.
>
> I did test the patch by crating an account in AD and then ticking the
> "Account is disabled" box. PAM returned error code 6, which is what
I'd
> expect.
>
> ACK
Did the old code return the wrong error too ?
Yes, before the patch I see:
Jan 14 16:23:51 adclient.win.trust.test su[3745]: pam_sss(su-l:auth): received for user
lockuser: 13 (User account has expired)
With the patched code I see:
Jan 14 16:26:13 adclient.win.trust.test su[27524]: pam_sss(su-l:auth): received for user
lockuser: 6 (Permission denied)
I haven't looked at the AD case only IPA when I coded it but AD
and IPA
share the krb5 provider so I guess testing either would be fine ...
Yes, the PAM error codes are exactly the same after "ipa user-disable".
OK to push now?