[SSSD] [PATCHES] Add pam_pwd_expiration_warning config option
Sumit Bose
sbose at redhat.com
Wed Jan 19 13:56:17 UTC 2011
Hi,
another new option, this time it is pam_pwd_expiration_warning the
number of days a warning should be displayed before the password
expires.
While writing this patch I realized that it might not be a good idea to
set pam_verbosity to 0 (no message at all) if confdb_get_int() fails.
The second patch sets it to DEFAULT_PAM_VERBOSITY.
bye,
Sumit
-------------- next part --------------
From 02a29524307b66bb58135ed42e9dd812423a57b3 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 19 Jan 2011 08:52:20 +0100
Subject: [PATCH 1/2] Add pam_pwd_expiration_warning config option
---
src/confdb/confdb.h | 1 +
src/config/SSSDConfig.py | 1 +
src/config/etc/sssd.api.conf | 1 +
src/man/sssd.conf.5.xml | 18 ++++++++++++
src/responder/pam/pamsrv_cmd.c | 59 +++++++++++++++++++++++++++++++--------
5 files changed, 68 insertions(+), 12 deletions(-)
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 5e55f25..7173c9f 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -82,6 +82,7 @@
#define CONFDB_DEFAULT_PAM_FAILED_LOGIN_DELAY 5
#define CONFDB_PAM_VERBOSITY "pam_verbosity"
#define CONFDB_PAM_ID_TIMEOUT "pam_id_timeout"
+#define CONFDB_PAM_PWD_EXPIRATION_WARNING "pam_pwd_expiration_warning"
/* Data Provider */
#define CONFDB_DP_CONF_ENTRY "config/dp"
diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 3191ad7..98a5dda 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -65,6 +65,7 @@ option_strings = {
'offline_failed_login_delay' : _('How long (minutes) to deny login after offline_failed_login_attempts has been reached'),
'pam_verbosity' : _('What kind of messages are displayed to the user during authentication'),
'pam_id_timeout' : _('How many seconds to keep identity information cached for PAM requests'),
+ 'pam_pwd_expiration_warning' : _('How many days before password expiration a warning should be displayed'),
# [provider]
'id_provider' : _('Identity provider'),
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 426c514..e915971 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -35,6 +35,7 @@ offline_failed_login_attempts = int, None, false
offline_failed_login_delay = int, None, false
pam_verbosity = int, None, false
pam_id_timeout = int, None, false
+pam_pwd_expiration_warning = int, None, false
[provider]
#Available provider types
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 449c01f..6ac9de8 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -462,6 +462,24 @@
</para>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term>pam_pwd_expiration_warning (integer)</term>
+ <listitem>
+ <para>
+ Display a warning N days before the password expires.
+ </para>
+ <para>
+ Please note that the backend server has to provide
+ information about the expiration time of the password.
+ If this information is missing, sssd cannot display a
+ warning.
+ </para>
+ <para>
+ Default: 7
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect2>
</refsect1>
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index bb42f71..ba105a5 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -39,6 +39,7 @@ enum pam_verbosity {
};
#define DEFAULT_PAM_VERBOSITY PAM_VERBOSITY_IMPORTANT
+#define DEFAULT_PAM_PWD_EXPIRATION_WARNING 7
static void pam_reply(struct pam_auth_req *preq);
@@ -327,12 +328,43 @@ fail:
return ret;
}
-static errno_t filter_responses(struct response_data *resp_list,
- int pam_verbosity)
+static errno_t filter_responses(struct confdb_ctx *cdb,
+ struct response_data *resp_list)
{
+ int ret;
struct response_data *resp;
uint32_t user_info_type;
int64_t expire_date;
+ uint32_t expire_warn;
+ TALLOC_CTX *tmp_ctx;
+ int pam_verbosity;
+ int pam_expiration_warning;
+
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL) {
+ DEBUG(1, ("talloc_new failed.\n"));
+ return ENOMEM;
+ }
+
+ ret = confdb_get_int(cdb, tmp_ctx, CONFDB_PAM_CONF_ENTRY,
+ CONFDB_PAM_VERBOSITY, DEFAULT_PAM_VERBOSITY,
+ &pam_verbosity);
+ if (ret != EOK) {
+ DEBUG(1, ("Failed to read PAM verbosity, not fatal.\n"));
+ pam_verbosity = 0;
+ }
+
+
+ ret = confdb_get_int(cdb, tmp_ctx, CONFDB_PAM_CONF_ENTRY,
+ CONFDB_PAM_PWD_EXPIRATION_WARNING,
+ DEFAULT_PAM_PWD_EXPIRATION_WARNING,
+ &pam_expiration_warning);
+ if (ret != EOK) {
+ DEBUG(1, ("Failed to read PAM expiration warning, not fatal.\n"));
+ pam_expiration_warning = DEFAULT_PAM_PWD_EXPIRATION_WARNING;
+ }
+
+ talloc_free(tmp_ctx);
resp = resp_list;
@@ -369,6 +401,18 @@ static errno_t filter_responses(struct response_data *resp_list,
}
break;
+ case SSS_PAM_USER_INFO_EXPIRE_WARN:
+ if (resp->len != 2 * sizeof(uint32_t)) {
+ DEBUG(1, ("User info expire warning entry is "
+ "too short.\n"));
+ return EINVAL;
+ }
+ memcpy(&expire_warn, resp->data + sizeof(uint32_t),
+ sizeof(uint32_t));
+ if(expire_warn > pam_expiration_warning * (60 * 60 * 24)) {
+ resp->do_not_send_to_client = true;
+ }
+ break;
default:
DEBUG(7, ("User info type [%d] not filtered.\n"));
}
@@ -415,7 +459,6 @@ static void pam_reply(struct pam_auth_req *preq)
uint32_t user_info_type;
time_t exp_date = -1;
time_t delay_until = -1;
- int pam_verbosity = 0;
pd = preq->pd;
cctx = preq->cctx;
@@ -516,15 +559,7 @@ static void pam_reply(struct pam_auth_req *preq)
goto done;
}
- ret = confdb_get_int(pctx->rctx->cdb, pd, CONFDB_PAM_CONF_ENTRY,
- CONFDB_PAM_VERBOSITY, DEFAULT_PAM_VERBOSITY,
- &pam_verbosity);
- if (ret != EOK) {
- DEBUG(1, ("Failed to read PAM verbosity, not fatal.\n"));
- pam_verbosity = 0;
- }
-
- ret = filter_responses(pd->resp_list, pam_verbosity);
+ ret = filter_responses(pctx->rctx->cdb, pd->resp_list);
if (ret != EOK) {
DEBUG(1, ("filter_responses failed, not fatal.\n"));
}
--
1.7.3.3
-------------- next part --------------
From 365d9ef3c322bfccb8f798368d5e03fe3bfd21d4 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 19 Jan 2011 14:39:47 +0100
Subject: [PATCH 2/2] Use DEFAULT_PAM_VERBOSITY if config value cannot be retrieved
---
src/responder/pam/pamsrv_cmd.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index ba105a5..830fdc4 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -351,7 +351,7 @@ static errno_t filter_responses(struct confdb_ctx *cdb,
&pam_verbosity);
if (ret != EOK) {
DEBUG(1, ("Failed to read PAM verbosity, not fatal.\n"));
- pam_verbosity = 0;
+ pam_verbosity = DEFAULT_PAM_VERBOSITY;
}
--
1.7.3.3
More information about the sssd-devel
mailing list