[SSSD] [PATCH] LDAP: Do not shortcut on ret != EOK during password expiry check

Jakub Hrozek jhrozek at redhat.com
Wed Aug 20 14:56:04 UTC 2014


https://fedorahosted.org/sssd/ticket/2323

The functions that check for password expiration can return non-zero
return codes not only on internal failure, but also to indicate that the
password was expired. The code would in this case shortcut in the error
handler instead of making its way to the switch-case code below that
translates the SSSD error codes into PAM error codes.

We don't lose the error reporting, because any internal error would
translate into PAM_SYSTEM_ERROR anyway.
-------------- next part --------------
>From 563ebe442d546c8cc7e71a93b45c88241088c277 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 20 Aug 2014 16:44:49 +0200
Subject: [PATCH] LDAP: Do not shortcut on ret != EOK during password expiry
 check

https://fedorahosted.org/sssd/ticket/2323

The functions that check for password expiration can return non-zero
return codes not only on internal failure, but also to indicate that the
password was expired. The code would in this case shortcut in the error
handler instead of making its way to the switch-case code below that
translates the SSSD error codes into PAM error codes.

We don't lose the error reporting, because any internal error would
translate into PAM_SYSTEM_ERROR anyway.
---
 src/providers/ldap/ldap_auth.c | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index 40f297c160a0e1710f3e66ff113dc89f7fc8be8f..5a40c1359f138c42eb915e873fe21a50ab038e81 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -1250,30 +1250,15 @@ static void sdap_pam_auth_done(struct tevent_req *req)
         switch (pw_expire_type) {
         case PWEXPIRE_SHADOW:
             ret = check_pwexpire_shadow(pw_expire_data, time(NULL), state->pd);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_CRIT_FAILURE, "check_pwexpire_shadow failed.\n");
-                state->pd->pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
             break;
         case PWEXPIRE_KERBEROS:
             ret = check_pwexpire_kerberos(pw_expire_data, time(NULL),
                                           state->pd,
                                           be_ctx->domain->pwd_expiration_warning);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_CRIT_FAILURE, "check_pwexpire_kerberos failed.\n");
-                state->pd->pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
             break;
         case PWEXPIRE_LDAP_PASSWORD_POLICY:
             ret = check_pwexpire_ldap(state->pd, pw_expire_data,
                                       be_ctx->domain->pwd_expiration_warning);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_CRIT_FAILURE, "check_pwexpire_ldap failed.\n");
-                state->pd->pam_status = PAM_SYSTEM_ERR;
-                goto done;
-            }
             break;
         case PWEXPIRE_NONE:
             break;
-- 
1.9.3



More information about the sssd-devel mailing list