[SSSD] [PATCH] Check for expired passwords in LDAP provider

Simo Sorce ssorce at redhat.com
Thu Oct 15 23:05:32 UTC 2009


On Thu, 2009-10-15 at 14:20 +0200, Sumit Bose wrote:
> On Wed, Oct 14, 2009 at 07:45:46PM -0400, Simo Sorce wrote:
> > On Fri, 2009-10-09 at 21:38 +0200, Sumit Bose wrote:
> > > Hi,
> > > 
> > > with this patch the LDAP provider check typical attributes which
> > > determines the lifetime of a password. If there is more than one scheme
> > > available the following order is user:
> > >  - server side password policies
> > >  - Kerberos password attributes
> > >  - shadow attributes
> > > Currently only in the case of server side password policies the password
> > > can actually be changed. Kerberos password should be changed with the
> > > Kerberos backend.
> > 
> > The patch seem mostly ok, I have tried it against a freeipa server (so
> > haven't tested shadow or password control), and found a problem.
> > 
> > The kerberos expiration time is read as it was in local time. It is not
> > it is in UTC. This prevented the code from detecting as expired an
> > account the was just expired, as it thought, wrongly, that the
> > expiration time was 5 hours in the future (I am GMT-5 here).
> 
> fixed
> 
> > 
> > I think the shadow time checks may have a similar problem, but they use
> > a different method to test for expiration so I am not entirely sure,
> > please check that too.
> 
> I have adopted the calulations from pam_unix so it should be safe.
> 
> > 
> > So NACK until this is fixed.
> > 
> > Patch also need to be rebased as option definitions have been moved to
> > ldap_common.c
> 
> done, new version attached.

Ok I rebased the patch to apply against the latest master.
Acked and pushed.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list