[SSSD] [PATCH] print password complexity hint when change password failed

Jakub Hrozek jhrozek at redhat.com
Tue Jul 16 18:03:04 UTC 2013


On Tue, Jul 16, 2013 at 10:25:34AM +0200, Pavel Březina wrote:
> On 07/10/2013 04:32 PM, Jakub Hrozek wrote:
> >On Fri, Jun 21, 2013 at 02:49:51PM +0200, Pavel Březina wrote:
> >>Now the output looks like:
> >>
> >>$ su test-user
> >>Password:
> >>Password expired. Change your password now.
> >>Current Password:
> >>New password:
> >>Retype new password:
> >>Password change failed. Please make sure the password meets the complexity
> >>constraints.
> >>su: incorrect password
> >
> >This works but I think the change is too broad, the hint would now be
> >printed for any password change failure without a specific message and
> >that might be misleading.
> >
> >The reason why msg is zero-sized is that the user_error_message variable
> >in changepw_child() is overwritten with result_string which is "". So
> >one change might be to not overwrite user_error_message with empty
> >string.
> 
> For some reason Kerberos returns empty string but result_string.length = 30.
> 
> >The other change would be in changepw_child() -- we could
> >special-case when krb5_change_password() returns result_code 4
> >(Password change rejected) and then instead of sending
> >SSS_PAM_USER_INFO_CHPASS_ERROR send a new code
> >(SSS_PAM_USER_INFO_CHPASS_REJECTED?) that would instruct the user to
> >check password complexity settings.
> 
> How about this? I avoided new error code and chose to fill server message in
> provider. The output now looks like:
> 
> Password change failed. Server message: Please make sure the password meets
> the complexity constraints.

This works for me, I tested a couple of usual scenarios to make sure we
don't print this message too frequently, but seems like everything is
working fine.

Ack



More information about the sssd-devel mailing list