[SSSD] [PATCH] Add support for ADS pwdLastSet

Stephen Gallagher sgallagh at redhat.com
Fri Apr 15 13:54:13 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/11/2011 01:16 PM, Pierre Carrier wrote:
> Hello Stephen,
> 
> 
> On 11 Apr 2011, at 17:26, Stephen Gallagher wrote:
>> I have a question, first. Does Active Directory ALWAYS use this
>> attribute, or can shadowLastChange also exist? If they can both exist,
>> which one should be the primary for best compatibility (i.e. does AD
>> define that one of them should overrule the other?)
> 
> You can definitely at least choose to create shadow* attributes yourself, obviously.
> 
> shadowLastChange _is_ defined on:
> http://msdn.microsoft.com/en-us/library/ms679790(v=vs.85).aspx
> 
> [MS-ADTS] does not seem to enforce the existence of pwdLastSet, but it has FLAG_ATTR_IS_CRITICAL.
> 
> I'd go with:
> - if shadowLastChange is here, use it
> - if not, if pwdLastChanged is here, use it
> - if not, fail miserably
> 
>> Please suppress whitespace on empty lines. It's very painful for those
>> of us with editors that highlight this in red :)
> 
> Sorry, it even happens to be the case in my usual vim.
> 
>> I note also that your calculation was wrong, because it was dealing in
> 
>> nanoseconds, but pwdLastSet is a count of HUNDRED nanosecond blocks.
> 
> I have to admit I stole this in nss_ldap, where it is not documented either.
> 
> I'm surprised they made this mistake, I'll make sure to fix this.
> 
>> Finally, your assignment to the 'days' variable (which is a long) from
>> an action involving two long long variables is risky. It would be wiser
>> for 'days' to be a long long which you then test for whether it exceeds
>> LONG_MAX.
> 
> I'll fix this too.
> 
> 
> You can expect a new patch soon :)


Actually, upon further thought, it's probably a bad idea to use
ldap_pwd_policy = shadow at all here.

It would make much more sense to implement a new policy type and handle
this there.

So we would want ldap_pwd_policy = ad.

Then we wouldn't be doing any of this hacking around shadowLastChange
either (and in the future we can expand password policy support to any
other available attributes)

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2oTgUACgkQeiVVYja6o6NOXwCfU3x/hLKNXJjFXucwy4EFlo8z
kioAoI26//gBF8vV5YGzkt4tfNnwL1Q/
=Ckl4
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list