[SSSD] [PATCH] Convert the value of pwd_exp_warning to seconds

Jakub Hrozek jhrozek at redhat.com
Tue Jan 22 17:12:12 UTC 2013


On Tue, Jan 22, 2013 at 11:11:51AM +0100, Sumit Bose wrote:
> On Tue, Jan 22, 2013 at 09:35:18AM +0100, Jakub Hrozek wrote:
> > On Sat, Jan 19, 2013 at 07:19:38PM +0100, Jakub Hrozek wrote:
> > > https://fedorahosted.org/sssd/ticket/1773
> > > 
> > > Commit bf8cce77a35cb0a3cdb0d21fb9c39b7b6372bc11 broke
> > > pam_pwd_expiration_warning because it started treating its value as if
> > > it was seconds, but in fact it's days.
> > > 
> > > I tested the path that hits parse_krb5_child_response() and the one that
> > > goes through check_pwexpire_ldap() but I'm not entirely sure how to test
> > > the LDAP authentication that uses check_pwexpire_kerberos(). Could
> > > anyone educate me (or test the patch as part of review maybe?).
> > > 
> > > I also don't like that the Kerberos password expiration is checked in
> > > the provider and the LDAP password expiration in the responder. I think
> > > this kind of logic belongs to the responder only. I filed #1774 to get
> > > it fixed, but since this patch is intended for the 1.9.4 release that is
> > > going to happen after Wednesday, I think we can do the refactor
> > > separately.
> > 
> > This patch was wrong and Sumit nacked it on IRC. It is enough to convert
> > the values coming from the [pam] section to seconds.
> 
> ACK, I tested this patch with pwd_expiration_warning and
> pam_pwd_expiration_warning and both are working as expected now. I used
> check_pwexpire_kerberos() for testing. This method was introduced to
> allow to use FreeIPA as a pure LDAP server with LDAP authentication.
> Here is expiration time is stored krbPasswordExpiration attribute.
> 
> bye,
> Sumit

Pushed to master and sssd-1-9

(Sorry, late pushmail. I thought I already sent it)



More information about the sssd-devel mailing list