[SSSD] [PATCH] ldap, krb5: More descriptive msg on chpass failure.

Jakub Hrozek jhrozek at redhat.com
Sun Aug 11 19:22:22 UTC 2013


On Sun, Aug 11, 2013 at 08:32:55PM +0200, Jakub Hrozek wrote:
> On Fri, Aug 09, 2013 at 09:44:06PM +0200, Michal Židek wrote:
> > During password change operation if wrong current password was given
> > we gave no hint to the user about what went wrong. The "Authentication
> > token manipulation error" message alone was not very descriptive.
> > 
> > resolves:
> > https://fedorahosted.org/sssd/ticket/2029
> > 
> > Thanks
> > Michal
> 
> Works fine:
> 
> su - tuser
> Password: 
> Last login: Sun Aug 11 20:29:44 CEST 2013 on pts/1
> -sh-4.2$ passwd
> Changing password for user tuser.
> Current Password: 
> Password change failed. Server message: Old password not accepted.
> passwd: Authentication token manipulation error
> 
> Maybe in another patch we can amend pack_user_info_chpass_error() to not
> require the last two parameters and just pass NULL, but that's not
> required now.
> 
> ACK

Pushed to master and sssd-1-10.

Attached is a 1.9 backport that I'm going to push to sssd-1-9
-------------- next part --------------
>From cd2225e59911d9cb7ffc2ff74012b554bb88500a Mon Sep 17 00:00:00 2001
From: Michal Zidek <mzidek at redhat.com>
Date: Fri, 9 Aug 2013 15:17:48 -0400
Subject: [PATCH] ldap, krb5: More descriptive msg on chpass failure.

Print more descriptive message when wrong current password
is given during password change operation.

resolves:
https://fedorahosted.org/sssd/ticket/2029
---
 src/providers/krb5/krb5_child.c | 16 ++++++++++++++++
 src/providers/ldap/ldap_auth.c  | 15 +++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index cd6f7e34ad91441467570baa97fddd0e4a286c50..73575b88b5b6d36fa8c755463a3c32b0c3e9deb0 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -1079,6 +1079,8 @@ static errno_t changepw_child(int fd, struct krb5_req *kr)
     const char *realm_name;
     int realm_length;
     krb5_get_init_creds_opt *chagepw_options;
+    size_t msg_len;
+    uint8_t *msg;
 
     DEBUG(SSSDBG_TRACE_LIBS, ("Password change operation\n"));
 
@@ -1117,6 +1119,20 @@ static errno_t changepw_child(int fd, struct krb5_req *kr)
                                         chagepw_options);
     sss_krb5_get_init_creds_opt_free(kr->ctx, chagepw_options);
     if (kerr != 0) {
+        ret = pack_user_info_chpass_error(kr->pd, "Old password not accepted.",
+                                          &msg_len, &msg);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  ("pack_user_info_chpass_error failed.\n"));
+        } else {
+            ret = pam_add_response(kr->pd, SSS_PAM_USER_INFO, msg_len,
+                                   msg);
+            if (ret != EOK) {
+                DEBUG(SSSDBG_CRIT_FAILURE,
+                      ("pam_add_response failed.\n"));
+            }
+        }
+
         pam_status = kerr_handle_error(kerr);
         goto sendresponse;
     }
diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index 6aba14c968b398cf7754d66cd8166402e6c8db49..80528230020660ae8dd70563dd03abd81d4262b9 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -815,6 +815,8 @@ static void sdap_auth4chpass_done(struct tevent_req *req)
     void *pw_expire_data;
     int dp_err = DP_ERR_FATAL;
     int ret;
+    size_t msg_len;
+    uint8_t *msg;
 
     ret = auth_recv(req, state, &state->sh,
                     &result, &state->dn,
@@ -899,6 +901,19 @@ static void sdap_auth4chpass_done(struct tevent_req *req)
         break;
     case SDAP_AUTH_FAILED:
         state->pd->pam_status = PAM_AUTH_ERR;
+        ret = pack_user_info_chpass_error(state->pd, "Old password not accepted.",
+                                          &msg_len, &msg);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  ("pack_user_info_chpass_error failed.\n"));
+        } else {
+            ret = pam_add_response(state->pd, SSS_PAM_USER_INFO, msg_len,
+                                    msg);
+            if (ret != EOK) {
+               DEBUG(SSSDBG_CRIT_FAILURE, ("pam_add_response failed.\n"));
+            }
+        }
+
         break;
     case SDAP_UNAVAIL:
         state->pd->pam_status = PAM_AUTHINFO_UNAVAIL;
-- 
1.8.3.1



More information about the sssd-devel mailing list