[SSSD] [PATCH] Display the last grace warning, too

Jakub Hrozek jhrozek at redhat.com
Mon Apr 22 10:33:11 UTC 2013


The attached patch fixes displaying of the last grace password warning,
iow when grace == 0. I checked that this is what pam_ldap does, too.

The patch has been tested by a GSS engineer.
-------------- next part --------------
>From 9173922c8c4291b93533bddfe9487084b968db2e Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 22 Apr 2013 11:38:27 +0200
Subject: [PATCH] Display the last grace warning, too

Due to a comparison error, the last warning when an LDAP password was in
its grace period was never displayed.

https://fedorahosted.org/sssd/ticket/1890
---
 src/providers/ldap/ldap_auth.c             | 4 ++--
 src/providers/ldap/sdap_async_connection.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index b0dd30ce61938e8af33d2f783d88c761177fe150..6aba14c968b398cf7754d66cd8166402e6c8db49 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -209,7 +209,7 @@ static errno_t check_pwexpire_ldap(struct pam_data *pd,
                                    enum sdap_result *result,
                                    int pwd_exp_warning)
 {
-    if (ppolicy->grace > 0 || ppolicy->expire > 0) {
+    if (ppolicy->grace >= 0 || ppolicy->expire > 0) {
         uint32_t *data;
         uint32_t *ptr;
         int ret;
@@ -225,7 +225,7 @@ static errno_t check_pwexpire_ldap(struct pam_data *pd,
         }
 
         ptr = data;
-        if (ppolicy->grace > 0) {
+        if (ppolicy->grace >= 0) {
             *ptr = SSS_PAM_USER_INFO_GRACE_LOGIN;
             ptr++;
             *ptr = ppolicy->grace;
diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c
index ff99248433026608f06fc548824fa2dd25aaacaa..44536c73006074b5ed6f9bebee8cabeeb77e8746 100644
--- a/src/providers/ldap/sdap_async_connection.c
+++ b/src/providers/ldap/sdap_async_connection.c
@@ -608,7 +608,7 @@ static void simple_bind_done(struct sdap_op *op,
                               ("Password was reset. "
                                "User must set a new password.\n"));
                         state->result = LDAP_X_SSSD_PASSWORD_EXPIRED;
-                    } else if (pp_grace > 0) {
+                    } else if (pp_grace >= 0) {
                         DEBUG(SSSDBG_TRACE_LIBS,
                               ("Password expired. "
                                "[%d] grace logins remaining.\n",
-- 
1.8.1.4



More information about the sssd-devel mailing list