I did not see any extended error messages in the debug logs, actually I am using Oracle
Enterprise Linux 6 (OEL6) so the version of sssd I am on is 1.9.2-82.7, it looks like the
fix that you spoke about earlier is in 1.10.1x and later, so I'm guessing I'm just
going to have to wait until OEL catches up to implement the version that fixes it unless
there is a temporary workaround of some sort.
Thanks,
Daniel
-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Jakub Hrozek
Sent: Friday, September 13, 2013 7:18 AM
To: sssd-users(a)lists.fedorahosted.org
Subject: Re: [SSSD-users] Need help configuring fine grained password policy
On Thu, Sep 12, 2013 at 03:21:51PM -0400, Dmitri Pal wrote:
On 09/12/2013 03:14 PM, Bright, Daniel wrote:
>
> Jakub,
>
>
>
> Thanks for the response, I figured out why I was getting the
> constraint violation, in my case it was because I have the
> “passwordminage” set for my policy, when I changed the user
> attribute “passwordallowchangetime” to the current date then I was
> able to perform the passwd operation. So at this point I believe the
> password policy is being applied, however I am just not getting all
> of the responses I would like, I get things like “password is too
> short”, “your password will expire in X days”, but I would expect to
> get something like “You cannot change your password again for X
> days” from the above
>
>
>
> This leads me to another question, is there a way I can map certain
> responses to responses that I define?
>
The responses are related to error codes that the server returns. I do
not think you can define them unless the DS you use allows you to.
In SSSD you definitely can't. We just propagate what we got from the
server to the user. There was a bug in that area that has been fixed
recently as Jakub mentioned earlier.
https://fedorahosted.org/sssd/ticket/1827
Exactly. Did you maybe see some extended error message coming from the server in the debug
logs? If yes, then we could pass that on, maybe based on pam_verbosity setting.
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users