[SSSD] [PATCH] use old password if available during password change
Sumit Bose
sbose at redhat.com
Fri Oct 9 19:02:15 UTC 2009
Hi,
this one should fix #223. Because sshd runs as root the old password was
not sent to sssd and changing the user password failed. Please review
carefully.
bye,
Sumit
-------------- next part --------------
>From 5573884b6a93ac3bd2bf52684a9dcbaf4d38a243 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 9 Oct 2009 20:52:25 +0200
Subject: [PATCH] use old password if available during password change
- if the password is reset by root we do not ask for a password during
PAM_PRELIM_CHECK. But if there is one available during PAM_UPDATE_AUTHTOK
we will use it, because now we are in an expired password dialog.
---
sss_client/pam_sss.c | 17 +++++++++--------
1 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/sss_client/pam_sss.c b/sss_client/pam_sss.c
index 4755cd3..411afd1 100644
--- a/sss_client/pam_sss.c
+++ b/sss_client/pam_sss.c
@@ -735,18 +735,19 @@ static int get_authtok_for_password_change(pam_handle_t *pamh,
return PAM_SUCCESS;
}
- if (getuid() != 0) {
- pi->pam_authtok_type = SSS_AUTHTOK_TYPE_PASSWORD;
- pi->pam_authtok = strdup(pi->pamstack_oldauthtok);
- if (pi->pam_authtok == NULL) {
+ if (pi->pamstack_oldauthtok == NULL) {
+ if (getuid() != 0) {
D(("no password found for chauthtok"));
return PAM_BUF_ERR;
+ } else {
+ pi->pam_authtok_type = SSS_AUTHTOK_TYPE_EMPTY;
+ pi->pam_authtok = NULL;
+ pi->pam_authtok_size = 0;
}
- pi->pam_authtok_size = strlen(pi->pam_authtok);
} else {
- pi->pam_authtok_type = SSS_AUTHTOK_TYPE_EMPTY;
- pi->pam_authtok = NULL;
- pi->pam_authtok_size = 0;
+ pi->pam_authtok = strdup(pi->pamstack_oldauthtok);
+ pi->pam_authtok_type = SSS_AUTHTOK_TYPE_PASSWORD;
+ pi->pam_authtok_size = strlen(pi->pam_authtok);
}
if (flags & FLAGS_USE_AUTHTOK) {
--
1.6.2.5
More information about the sssd-devel
mailing list