[SSSD] [PATCH] print password complexity hint when change password failed
Jakub Hrozek
jhrozek at redhat.com
Wed Jul 10 14:32:52 UTC 2013
On Fri, Jun 21, 2013 at 02:49:51PM +0200, Pavel Březina wrote:
> Now the output looks like:
>
> $ su test-user
> Password:
> Password expired. Change your password now.
> Current Password:
> New password:
> Retype new password:
> Password change failed. Please make sure the password meets the complexity
> constraints.
> su: incorrect password
This works but I think the change is too broad, the hint would now be
printed for any password change failure without a specific message and
that might be misleading.
The reason why msg is zero-sized is that the user_error_message variable
in changepw_child() is overwritten with result_string which is "". So
one change might be to not overwrite user_error_message with empty
string.
The other change would be in changepw_child() -- we could
special-case when krb5_change_password() returns result_code 4
(Password change rejected) and then instead of sending
SSS_PAM_USER_INFO_CHPASS_ERROR send a new code
(SSS_PAM_USER_INFO_CHPASS_REJECTED?) that would instruct the user to
check password complexity settings.
More information about the sssd-devel
mailing list