On Thu, Jan 14, 2016 at 11:03:51AM -0500, Simo Sorce wrote:
On Thu, 2016-01-14 at 12:41 +0100, Jakub Hrozek wrote:
> On Wed, Jan 13, 2016 at 02:56:25PM -0500, Simo Sorce wrote:
> > subj says it all,
> > bug: https://fedorahosted.org/sssd/ticket/2924
> > I have compiled and run make check|intgcheck but "not" actively
> > this patch.
> I did test the patch by crating an account in AD and then ticking the
> "Account is disabled" box. PAM returned error code 6, which is what
Did the old code return the wrong error too ?
Yes, before the patch I see:
Jan 14 16:23:51 adclient.win.trust.test su: pam_sss(su-l:auth): received for user
lockuser: 13 (User account has expired)
With the patched code I see:
Jan 14 16:26:13 adclient.win.trust.test su: pam_sss(su-l:auth): received for user
lockuser: 6 (Permission denied)
I haven't looked at the AD case only IPA when I coded it but AD
share the krb5 provider so I guess testing either would be fine ...
Yes, the PAM error codes are exactly the same after "ipa user-disable".
OK to push now?