[SSSD] [PATCH] Improve password policy error code and message
Sumit Bose
sbose at redhat.com
Thu Aug 25 12:21:59 UTC 2011
Hi,
if we request e.g. the shadow password policy but a user does not have the
corresponding attributes the following log message is shown:
(Thu Aug 25 06:22:59 2011) [sssd[be[LDAP]]] [find_password_expiration_attributes] (1): No shadow password attributes found, but shadow password policy was requested.
(Thu Aug 25 06:22:59 2011) [sssd[be[LDAP]]] [get_user_dn] (1): find_password_expiration_attributes failed.
(Thu Aug 25 06:22:59 2011) [sssd[be[LDAP]]] [sdap_handle_release] (8): Trace: sh[0x241b610], connected[1], ops[(nil)], ldap[0x241e270], destructor_lock[0], release_memory[0]
(Thu Aug 25 06:22:59 2011) [sssd[be[LDAP]]] [remove_connection_callback] (9): Successfully removed connection callback.
(Thu Aug 25 06:22:59 2011) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (3, 4, <NULL>) [Internal Error (System error)]
Kaushik mentioned that "Backend returned: (3, 4, <NULL>) [Internal Error
(System error)]" might irritate the admin who tries to find out why the access
was denied. The attached patch changes this to:
(Thu Aug 25 13:06:15 2011) [sssd[be[ldap]]] [find_password_expiration_attributes] (1): No shadow password attributes found, but shadow password policy was requested. Access will be denied.
(Thu Aug 25 13:06:15 2011) [sssd[be[ldap]]] [get_user_dn] (1): find_password_expiration_attributes failed.
(Thu Aug 25 13:06:15 2011) [sssd[be[ldap]]] [sdap_handle_release] (8): Trace: sh[0x87d3b28], connected[1], ops[(nil)], ldap[0x87d4a58], destructor_lock[0], release_memory[0]
(Thu Aug 25 13:06:15 2011) [sssd[be[ldap]]] [remove_connection_callback] (9): Successfully removed connection callback.
(Thu Aug 25 13:06:15 2011) [sssd[be[ldap]]] [be_pam_handler_callback] (4): Backend returned: (0, 6, <NULL>) [Success]
bye,
Sumit
-------------- next part --------------
From 50223acf268349eec0d6d00dc734e7d9fd24ec06 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 25 Aug 2011 13:15:26 +0200
Subject: [PATCH] Improve password policy error code and message
Instead of returning PAM_SYSTEM_ERR if they necessary attributes for the
requested password policy cannot be found we return PAM_PERM_DENIED.
Additionally the log message says that the access is denied.
---
src/providers/ldap/ldap_auth.c | 13 +++++++++----
1 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index ad4549e..ef4477c 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -278,8 +278,9 @@ static errno_t find_password_expiration_attributes(TALLOC_CTX *mem_ctx,
}
} else {
DEBUG(1, ("No Kerberos password expiration attributes found, "
- "but MIT Kerberos password policy was requested.\n"));
- return EINVAL;
+ "but MIT Kerberos password policy was requested. "
+ "Access will be denied.\n"));
+ return EACCES;
}
} else if (strcasecmp(pwd_policy, PWD_POL_OPT_SHADOW) == 0) {
mark = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL);
@@ -321,8 +322,9 @@ static errno_t find_password_expiration_attributes(TALLOC_CTX *mem_ctx,
return EOK;
} else {
DEBUG(1, ("No shadow password attributes found, "
- "but shadow password policy was requested.\n"));
- return EINVAL;
+ "but shadow password policy was requested. "
+ "Access will be denied.\n"));
+ return EACCES;
}
}
@@ -661,6 +663,9 @@ int auth_recv(struct tevent_req *req,
if (err == ETIMEDOUT) {
*result = SDAP_UNAVAIL;
return EOK;
+ } else if (err == EACCES) {
+ *result = SDAP_AUTH_FAILED;
+ return EOK;
} else {
*result = SDAP_ERROR;
return err;
--
1.7.6
More information about the sssd-devel
mailing list