[SSSD] [PATCH] Convert the value of pwd_exp_warning to seconds
Jakub Hrozek
jhrozek at redhat.com
Tue Jan 22 17:12:12 UTC 2013
On Tue, Jan 22, 2013 at 11:11:51AM +0100, Sumit Bose wrote:
> On Tue, Jan 22, 2013 at 09:35:18AM +0100, Jakub Hrozek wrote:
> > On Sat, Jan 19, 2013 at 07:19:38PM +0100, Jakub Hrozek wrote:
> > > https://fedorahosted.org/sssd/ticket/1773
> > >
> > > Commit bf8cce77a35cb0a3cdb0d21fb9c39b7b6372bc11 broke
> > > pam_pwd_expiration_warning because it started treating its value as if
> > > it was seconds, but in fact it's days.
> > >
> > > I tested the path that hits parse_krb5_child_response() and the one that
> > > goes through check_pwexpire_ldap() but I'm not entirely sure how to test
> > > the LDAP authentication that uses check_pwexpire_kerberos(). Could
> > > anyone educate me (or test the patch as part of review maybe?).
> > >
> > > I also don't like that the Kerberos password expiration is checked in
> > > the provider and the LDAP password expiration in the responder. I think
> > > this kind of logic belongs to the responder only. I filed #1774 to get
> > > it fixed, but since this patch is intended for the 1.9.4 release that is
> > > going to happen after Wednesday, I think we can do the refactor
> > > separately.
> >
> > This patch was wrong and Sumit nacked it on IRC. It is enough to convert
> > the values coming from the [pam] section to seconds.
>
> ACK, I tested this patch with pwd_expiration_warning and
> pam_pwd_expiration_warning and both are working as expected now. I used
> check_pwexpire_kerberos() for testing. This method was introduced to
> allow to use FreeIPA as a pure LDAP server with LDAP authentication.
> Here is expiration time is stored krbPasswordExpiration attribute.
>
> bye,
> Sumit
Pushed to master and sssd-1-9
(Sorry, late pushmail. I thought I already sent it)
More information about the sssd-devel
mailing list