[SSSD] [PATCHES] SDAP: enable change phase of pw expire policy check
Jakub Hrozek
jhrozek at redhat.com
Tue Mar 3 17:55:20 UTC 2015
On Tue, Mar 03, 2015 at 06:27:54PM +0100, Sumit Bose wrote:
> On Sun, Mar 01, 2015 at 08:29:50PM +0100, Pavel Reichl wrote:
> >
> > On 02/27/2015 12:01 PM, Sumit Bose wrote:
> > >On Tue, Feb 24, 2015 at 04:44:28PM +0100, Pavel Reichl wrote:
> > >>On 02/23/2015 11:47 AM, Sumit Bose wrote:
> > >>>On Fri, Feb 20, 2015 at 02:44:45PM +0100, Pavel Reichl wrote:
> > >>>>On 02/20/2015 02:33 PM, Lukas Slebodnik wrote:
> > >>>>>On (20/02/15 14:23), Pavel Reichl wrote:
> > >>>>>>On 02/19/2015 06:16 PM, Sumit Bose wrote:
> > >>>>>>>On Tue, Feb 17, 2015 at 10:56:43PM +0100, Pavel Reichl wrote:
> > >>>>>>>>Hello,
> > >>>>>>>>
> > >>>>>>>>please see attached patches resolving
> > >...
> > >
> > >>>>index 9f2e9ac34add13e40d316374094024afdcc4ae31..4e3f3510250b19b5f397125fa3e3a376e0d3701f 100644
> > >>>>--- a/src/man/sssd-ldap.5.xml
> > >>>>+++ b/src/man/sssd-ldap.5.xml
> > >>>>@@ -1959,6 +1959,18 @@ ldap_access_filter = (employeeType=admin)
> > >>>> ldap_account_expire_policy
> > >>>> </para>
> > >>>> <para>
> > >>>>+ <emphasis>pwd_expire_policy</emphasis>:
> > >>>>+ This option is useful if users are interested in
> > >>>>+ seeing password expiration warning when authenticating
> > >>>>+ using different method then passwords - for example
> > >>>>+ SSH keys.
> > >>>It's not about seeing a warning but about denying access based on an
> > >>>expired password. I think you should be more clear here.
> > >I'm sorry I wasn'T clear either. I meant to say 'it's not only about a
> > >warning'. So you should mention both, the user will see a warning if the
> > >password is about to expire and will be rejected if the password is
> > >expired as with password authentication
> > >
> > >>>>+ </para>
> > >>>>+ <para>
> > >>>>+ Please note that 'access_provider = ldap' must
> > >>>>+ be set for this feature to work. Also 'ldap_pwd_policy'
> > >>>>+ must be set to appropriate password policy.
> > >>>>+ </para>
> > >...
> > >
> > >>>>+ return ret;
> > >>>I think you have to modify the return code here to match the access
> > >>>control expectations. check_pwexpire_policy() will e.g. return
> > >>>ERR_PASSWORD_EXPIRED but the access control code expects
> > >>>ERR_ACCESS_DENIED. As a result I see the following in the logs:
> > >>In attached patch I modified sdap_access_done() instead:
> > >>
> > >>static void sdap_access_done(struct tevent_req *req)
> > >> case ERR_ACCOUNT_EXPIRED:
> > >> pam_status = PAM_ACCT_EXPIRED;
> > >> break;
> > >>+ case ERR_PASSWORD_EXPIRED:
> > >>+ pam_status = PAM_PERM_DENIED;
> > >>+ break;
> > >> default:
> > >> DEBUG(SSSDBG_CRIT_FAILURE, "Error retrieving access check
> > >>result.\n");
> > >> pam_status = PAM_SYSTEM_ERR;
> > >>
> > >>If you are OK with this approach would setting pam_status to
> > >>PAM_AUTHTOK_EXPIRED be more appropriate?
> > >That's a good point and it made me re-read to original tickets again. I
> > >was under the impression that they ask for rejecting access as well, but
> > >it looks thy only ask for a warning. Nevertheless I think it is a good
> > >idea to reject access and it relates a bit to #2534 as well.
> > >Nevertheless even if we reject your comment above made me think who we
> > >should react is the password is expired, just reject or ask for a new
> > >password as it would have been with password authentication.
> > >
> > >As a result I wonder if it would make sense to add 3 options:
> > >
> > >- pwd_expire_policy_reject: will warn and reject,
> > > pam_status = PAM_PERM_DENIED
> > >- pwd_expire_policy_warn: will only warn,
> > > pam_status = PAM_SUCCESS
> > >- pwd_expire_policy_renew: will warn and ask for new password
> > > pam_status = PAM_NEW_AUTHTOK_REQD
> > >
> > >What do you think?
> > >
> > >bye,
> > >Sumit
> > >
> > Thanks for comments. Please see attached patches.
>
> Thank you for your patience. Patches are looking good, working as
> expected and pass CI
> (http://sssd-ci.duckdns.org/logs/job/8/63/summary.html) so ACK.
>
> Nevertheless I can imagine that there will be request for a 'Password is
> expired' warning for the pwd_expire_policy_warn case (and maybe a syslog
> messages for the pwd_expire_policy_reject case). Would you mind to file
> a ticket about this so that we are prepared?
>
> bye,
> Sumit
* master:
* cdaa29d2c5724a4c72bfa0f42284ccfac3d5a464
* c9b0071bfcb8eb8c71e40248de46d23aceecc0f3
* sssd-1-12:
* 8b353dd2b90b7ab222acdea726ab7e8681752237
* d3f82e944dc5dab3812700a245deec4aa3245b21
More information about the sssd-devel
mailing list