[SSSD] [PATCH] print password complexity hint when change password failed

Pavel Březina pbrezina at redhat.com
Tue Jul 16 08:25:34 UTC 2013


On 07/10/2013 04:32 PM, Jakub Hrozek wrote:
> On Fri, Jun 21, 2013 at 02:49:51PM +0200, Pavel Březina wrote:
>> Now the output looks like:
>>
>> $ su test-user
>> Password:
>> Password expired. Change your password now.
>> Current Password:
>> New password:
>> Retype new password:
>> Password change failed. Please make sure the password meets the complexity
>> constraints.
>> su: incorrect password
>
> This works but I think the change is too broad, the hint would now be
> printed for any password change failure without a specific message and
> that might be misleading.
>
> The reason why msg is zero-sized is that the user_error_message variable
> in changepw_child() is overwritten with result_string which is "". So
> one change might be to not overwrite user_error_message with empty
> string.

For some reason Kerberos returns empty string but result_string.length = 30.

> The other change would be in changepw_child() -- we could
> special-case when krb5_change_password() returns result_code 4
> (Password change rejected) and then instead of sending
> SSS_PAM_USER_INFO_CHPASS_ERROR send a new code
> (SSS_PAM_USER_INFO_CHPASS_REJECTED?) that would instruct the user to
> check password complexity settings.

How about this? I avoided new error code and chose to fill server 
message in provider. The output now looks like:

Password change failed. Server message: Please make sure the password 
meets the complexity constraints.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-print-hint-about-password-complexity-when-new-passwo.patch
Type: text/x-patch
Size: 2545 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130716/c82d40e6/attachment.bin>


More information about the sssd-devel mailing list