[SSSD] [PATCH] use old password if available during password change
Sumit Bose
sbose at redhat.com
Mon Oct 12 12:49:09 UTC 2009
On Fri, Oct 09, 2009 at 04:29:42PM -0400, Simo Sorce wrote:
> On Fri, 2009-10-09 at 21:02 +0200, Sumit Bose wrote:
> > Hi,
> >
> > this one should fix #223. Because sshd runs as root the old password
> > was
> > not sent to sssd and changing the user password failed. Please review
> > carefully.
>
> I guess the problem here is to understand what do current pam modules,
> when used through the proxy backend, expect.
>
The current pam modules do not expect anything here, because they will
handle expired passowrd during pam_acct_mgmt and not during
pam_authenticate.
> Do they skip checks or ignore if the provided password is valid or not ?
> Should we think of forking a child in proxy and running it as the user
> that is attempting the password change? (Assuming we know it ?)
I think forking isn't needed here, because pam_sss should be kept
simple. Send everything you know to sssd and wait for a response.
bye,
Sumit
>
> Otherwise the patch looks sane to me, so I'd give a tentative ack.
>
> Simo.
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
More information about the sssd-devel
mailing list