[SSSD] [PATCH] Ignore shadow attributes

Sumit Bose sbose at redhat.com
Mon Nov 16 13:06:17 UTC 2009


Hi,

this patch should fix #279 by ignoring the shadow attributes by
default.

bye,
Sumit
-------------- next part --------------
>From 8bcd2646e948a1f05b279196a4e6f4350aa5d5a9 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 16 Nov 2009 13:56:57 +0100
Subject: [PATCH] Ignore shadow attributes

---
 server/man/sssd-ldap.5.xml          |   25 +++++++++++++++++++++++++
 server/providers/ldap/ldap_auth.c   |   19 +++++++++++++++++++
 server/providers/ldap/ldap_common.c |    3 ++-
 server/providers/ldap/sdap.h        |    1 +
 4 files changed, 47 insertions(+), 1 deletions(-)

diff --git a/server/man/sssd-ldap.5.xml b/server/man/sssd-ldap.5.xml
index a2aa730..c971a2c 100644
--- a/server/man/sssd-ldap.5.xml
+++ b/server/man/sssd-ldap.5.xml
@@ -582,6 +582,31 @@
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>ldap_ignore_shadow_attributes (boolean)</term>
+                    <listitem>
+                        <para>
+                            If set to true ignore the LDAP attributes
+                            corresponding to the values describes in
+                            <citerefentry><refentrytitle>shadow</refentrytitle>
+                            <manvolnum>5</manvolnum></citerefentry> during
+                            authentication, i.e. they are not used to evaluate
+                            if the password is expired.
+                        </para>
+                        <para>
+                            Default: true
+                        </para>
+                        <para>
+                            Please note that you should only set this value to
+                            false if there is a password change mechanism
+                            available which can update the last changed time.
+                            The current version of sssd
+                            <emphasis>does not</emphasis> update the
+                            corresponding attribute.
+                        </para>
+                    </listitem>
+                </varlistentry>
+
             </variablelist>
         </para>
     </refsect1>
diff --git a/server/providers/ldap/ldap_auth.c b/server/providers/ldap/ldap_auth.c
index a9f03a7..114fc36 100644
--- a/server/providers/ldap/ldap_auth.c
+++ b/server/providers/ldap/ldap_auth.c
@@ -572,6 +572,7 @@ struct sdap_pam_chpass_state {
     char *password;
     char *new_password;
     struct sdap_handle *sh;
+    struct sdap_auth_ctx *ctx;
 };
 
 static void sdap_auth4chpass_done(struct tevent_req *req);
@@ -611,6 +612,7 @@ void sdap_pam_chpass_handler(struct be_req *breq)
     if (!state) goto done;
 
     state->breq = breq;
+    state->ctx = ctx;
     state->pd = pd;
     state->username = pd->user;
     state->password = talloc_strndup(state,
@@ -661,6 +663,12 @@ static void sdap_auth4chpass_done(struct tevent_req *req)
     if (result == SDAP_AUTH_SUCCESS) {
         switch (pw_expire_type) {
             case PWEXPIRE_SHADOW:
+                if (dp_opt_get_bool(state->ctx->opts->basic,
+                                    SDAP_IGNORE_SHADOW_ATTRIBUTES)) {
+                    DEBUG(5, ("Ignoring shadow attributes.\n"));
+                    pw_expire_type = PWEXPIRE_NONE;
+                    break;
+                }
                 ret = check_pwexpire_shadow(pw_expire_data, time(NULL),
                                             &result);
                 if (ret != EOK) {
@@ -764,6 +772,7 @@ struct sdap_pam_auth_state {
     struct pam_data *pd;
     const char *username;
     struct dp_opt_blob password;
+    struct sdap_auth_ctx *ctx;
 };
 
 static void sdap_pam_auth_done(struct tevent_req *req);
@@ -798,6 +807,7 @@ void sdap_pam_auth_handler(struct be_req *breq)
 
         state->breq = breq;
         state->pd = pd;
+        state->ctx = ctx;
         state->username = pd->user;
         state->password.data = pd->authtok;
         state->password.length = pd->authtok_size;
@@ -846,6 +856,12 @@ static void sdap_pam_auth_done(struct tevent_req *req)
     if (result == SDAP_AUTH_SUCCESS) {
         switch (pw_expire_type) {
             case PWEXPIRE_SHADOW:
+                if (dp_opt_get_bool(state->ctx->opts->basic,
+                                    SDAP_IGNORE_SHADOW_ATTRIBUTES)) {
+                    DEBUG(5, ("Ignoring shadow attributes.\n"));
+                    pw_expire_type = PWEXPIRE_NONE;
+                    break;
+                }
                 ret = check_pwexpire_shadow(pw_expire_data, time(NULL),
                                             &result);
                 if (ret != EOK) {
@@ -883,6 +899,9 @@ static void sdap_pam_auth_done(struct tevent_req *req)
     case SDAP_UNAVAIL:
         state->pd->pam_status = PAM_AUTHINFO_UNAVAIL;
         break;
+    case SDAP_ACCT_EXPIRED:
+        state->pd->pam_status = PAM_ACCT_EXPIRED;
+        break;
     case SDAP_AUTH_PW_EXPIRED:
         state->pd->pam_status = PAM_AUTHTOK_EXPIRED;
         break;
diff --git a/server/providers/ldap/ldap_common.c b/server/providers/ldap/ldap_common.c
index deffb4a..bec4099 100644
--- a/server/providers/ldap/ldap_common.c
+++ b/server/providers/ldap/ldap_common.c
@@ -54,7 +54,8 @@ struct dp_option default_basic_opts[] = {
     { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     /* use the same parm name as the krb5 module so we set it only once */
-    { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING }
+    { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_ignore_shadow_attributes", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE }
 };
 
 struct sdap_attr_map generic_attr_map[] = {
diff --git a/server/providers/ldap/sdap.h b/server/providers/ldap/sdap.h
index 8330bd6..ac25ae7 100644
--- a/server/providers/ldap/sdap.h
+++ b/server/providers/ldap/sdap.h
@@ -117,6 +117,7 @@ enum sdap_basic_opt {
     SDAP_KRB5_KEYTAB,
     SDAP_KRB5_KINIT,
     SDAP_KRB5_REALM,
+    SDAP_IGNORE_SHADOW_ATTRIBUTES,
 
     SDAP_OPTS_BASIC /* opts counter */
 };
-- 
1.6.2.5



More information about the sssd-devel mailing list