Jakub,
Thanks for the response, I figured out why I was getting the constraint violation, in my case it was because I have the "passwordminage" set for my policy, when I changed the user attribute "passwordallowchangetime" to the current date then I was able to perform the passwd operation. So at this point I believe the password policy is being applied, however I am just not getting all of the responses I would like, I get things like "password is too short", "your password will expire in X days", but I would expect to get something like "You cannot change your password again for X days" from the above
This leads me to another question, is there a way I can map certain responses to responses that I define?
Thanks, Daniel B
On 09/12/2013 03:14 PM, Bright, Daniel wrote:
Jakub,
Thanks for the response, I figured out why I was getting the constraint violation, in my case it was because I have the “passwordminage” set for my policy, when I changed the user attribute “passwordallowchangetime” to the current date then I was able to perform the passwd operation. So at this point I believe the password policy is being applied, however I am just not getting all of the responses I would like, I get things like “password is too short”, “your password will expire in X days”, but I would expect to get something like “You cannot change your password again for X days” from the above
This leads me to another question, is there a way I can map certain responses to responses that I define?
The responses are related to error codes that the server returns. I do not think you can define them unless the DS you use allows you to. In SSSD you definitely can't. We just propagate what we got from the server to the user. There was a bug in that area that has been fixed recently as Jakub mentioned earlier.
https://fedorahosted.org/sssd/ticket/1827
You might however play some sort of a trick with translations and redefine the strings but this would really be a big hack.
Thanks,
Daniel B
sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
On Thu, Sep 12, 2013 at 03:21:51PM -0400, Dmitri Pal wrote:
On 09/12/2013 03:14 PM, Bright, Daniel wrote:
Jakub,
Thanks for the response, I figured out why I was getting the constraint violation, in my case it was because I have the “passwordminage” set for my policy, when I changed the user attribute “passwordallowchangetime” to the current date then I was able to perform the passwd operation. So at this point I believe the password policy is being applied, however I am just not getting all of the responses I would like, I get things like “password is too short”, “your password will expire in X days”, but I would expect to get something like “You cannot change your password again for X days” from the above
This leads me to another question, is there a way I can map certain responses to responses that I define?
The responses are related to error codes that the server returns. I do not think you can define them unless the DS you use allows you to. In SSSD you definitely can't. We just propagate what we got from the server to the user. There was a bug in that area that has been fixed recently as Jakub mentioned earlier.
Exactly. Did you maybe see some extended error message coming from the server in the debug logs? If yes, then we could pass that on, maybe based on pam_verbosity setting.
I did not see any extended error messages in the debug logs, actually I am using Oracle Enterprise Linux 6 (OEL6) so the version of sssd I am on is 1.9.2-82.7, it looks like the fix that you spoke about earlier is in 1.10.1x and later, so I'm guessing I'm just going to have to wait until OEL catches up to implement the version that fixes it unless there is a temporary workaround of some sort.
Thanks, Daniel
-----Original Message----- From: sssd-users-bounces@lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Jakub Hrozek Sent: Friday, September 13, 2013 7:18 AM To: sssd-users@lists.fedorahosted.org Subject: Re: [SSSD-users] Need help configuring fine grained password policy
On Thu, Sep 12, 2013 at 03:21:51PM -0400, Dmitri Pal wrote:
On 09/12/2013 03:14 PM, Bright, Daniel wrote:
Jakub,
Thanks for the response, I figured out why I was getting the constraint violation, in my case it was because I have the “passwordminage” set for my policy, when I changed the user attribute “passwordallowchangetime” to the current date then I was able to perform the passwd operation. So at this point I believe the password policy is being applied, however I am just not getting all of the responses I would like, I get things like “password is too short”, “your password will expire in X days”, but I would expect to get something like “You cannot change your password again for X days” from the above
This leads me to another question, is there a way I can map certain responses to responses that I define?
The responses are related to error codes that the server returns. I do not think you can define them unless the DS you use allows you to. In SSSD you definitely can't. We just propagate what we got from the server to the user. There was a bug in that area that has been fixed recently as Jakub mentioned earlier.
Exactly. Did you maybe see some extended error message coming from the server in the debug logs? If yes, then we could pass that on, maybe based on pam_verbosity setting. _______________________________________________ sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
On Fri, Sep 13, 2013 at 02:03:07PM +0000, Bright, Daniel wrote:
I did not see any extended error messages in the debug logs, actually I am using Oracle Enterprise Linux 6 (OEL6) so the version of sssd I am on is 1.9.2-82.7, it looks like the fix that you spoke about earlier is in 1.10.1x and later, so I'm guessing I'm just going to have to wait until OEL catches up
The fastest way to get a bug fixed in OEL is to buy a RHEL subscription :-) (sorry, just couldn't resist)
to implement the version that fixes it unless there is a temporary workaround of some sort.
There is no temporary workaround but the good news is that improved error reporting will be in RHEL-6.5, actually the fix for the upstream bug I referenced is currently in the 6.5 tree as part of fixing https://bugzilla.redhat.com/show_bug.cgi?id=983028 and https://bugzilla.redhat.com/show_bug.cgi?id=912470
The symptoms described in those bugs are slightly different, but the root cause was the same -- we didn't pass the info from the server up to the PAM stack.
sssd-users@lists.fedorahosted.org
-
Bright, Daniel -
Dmitri Pal -
Jakub Hrozek