[SSSD] [PATCHES] SDAP: enable change phase of pw expire policy check

Jakub Hrozek jhrozek at redhat.com
Tue Mar 3 17:55:20 UTC 2015


On Tue, Mar 03, 2015 at 06:27:54PM +0100, Sumit Bose wrote:
> On Sun, Mar 01, 2015 at 08:29:50PM +0100, Pavel Reichl wrote:
> > 
> > On 02/27/2015 12:01 PM, Sumit Bose wrote:
> > >On Tue, Feb 24, 2015 at 04:44:28PM +0100, Pavel Reichl wrote:
> > >>On 02/23/2015 11:47 AM, Sumit Bose wrote:
> > >>>On Fri, Feb 20, 2015 at 02:44:45PM +0100, Pavel Reichl wrote:
> > >>>>On 02/20/2015 02:33 PM, Lukas Slebodnik wrote:
> > >>>>>On (20/02/15 14:23), Pavel Reichl wrote:
> > >>>>>>On 02/19/2015 06:16 PM, Sumit Bose wrote:
> > >>>>>>>On Tue, Feb 17, 2015 at 10:56:43PM +0100, Pavel Reichl wrote:
> > >>>>>>>>Hello,
> > >>>>>>>>
> > >>>>>>>>please see attached patches resolving
> > >...
> > >
> > >>>>index 9f2e9ac34add13e40d316374094024afdcc4ae31..4e3f3510250b19b5f397125fa3e3a376e0d3701f 100644
> > >>>>--- a/src/man/sssd-ldap.5.xml
> > >>>>+++ b/src/man/sssd-ldap.5.xml
> > >>>>@@ -1959,6 +1959,18 @@ ldap_access_filter = (employeeType=admin)
> > >>>>                              ldap_account_expire_policy
> > >>>>                          </para>
> > >>>>                          <para>
> > >>>>+                            <emphasis>pwd_expire_policy</emphasis>:
> > >>>>+                            This option is useful if users are interested in
> > >>>>+                            seeing password expiration warning when authenticating
> > >>>>+                            using different method then passwords - for example
> > >>>>+                            SSH keys.
> > >>>It's not about seeing a warning but about denying access based on an
> > >>>expired password. I think you should be more clear here.
> > >I'm sorry I wasn'T clear either. I meant to say 'it's not only about a
> > >warning'. So you should mention both, the user will see a warning if the
> > >password is about to expire and will be rejected if the password is
> > >expired as with password authentication
> > >
> > >>>>+                        </para>
> > >>>>+                        <para>
> > >>>>+                            Please note that 'access_provider = ldap' must
> > >>>>+                            be set for this feature to work. Also 'ldap_pwd_policy'
> > >>>>+                            must be set to appropriate password policy.
> > >>>>+                        </para>
> > >...
> > >
> > >>>>+    return ret;
> > >>>I think you have to modify the return code here to match the access
> > >>>control expectations. check_pwexpire_policy() will e.g. return
> > >>>ERR_PASSWORD_EXPIRED but the access control code expects
> > >>>ERR_ACCESS_DENIED. As a result I see the following in the logs:
> > >>In attached patch I modified sdap_access_done() instead:
> > >>
> > >>static void sdap_access_done(struct tevent_req *req)
> > >>      case ERR_ACCOUNT_EXPIRED:
> > >>          pam_status = PAM_ACCT_EXPIRED;
> > >>          break;
> > >>+    case ERR_PASSWORD_EXPIRED:
> > >>+        pam_status = PAM_PERM_DENIED;
> > >>+        break;
> > >>      default:
> > >>          DEBUG(SSSDBG_CRIT_FAILURE, "Error retrieving access check
> > >>result.\n");
> > >>          pam_status = PAM_SYSTEM_ERR;
> > >>
> > >>If you are OK with this approach would setting pam_status to
> > >>PAM_AUTHTOK_EXPIRED be more appropriate?
> > >That's a good point and it made me re-read to original tickets again. I
> > >was under the impression that they ask for rejecting access as well, but
> > >it looks thy only ask for a warning. Nevertheless I think it is a good
> > >idea to reject access and it relates a bit to #2534 as well.
> > >Nevertheless even if we reject your comment above made me think who we
> > >should react is the password is expired, just reject or ask for a new
> > >password as it would have been with password authentication.
> > >
> > >As a result I wonder if it would make sense to add 3 options:
> > >
> > >- pwd_expire_policy_reject: will warn and reject,
> > >			    pam_status = PAM_PERM_DENIED
> > >- pwd_expire_policy_warn: will only warn,
> > >			    pam_status = PAM_SUCCESS
> > >- pwd_expire_policy_renew: will warn and ask for new password
> > >                             pam_status = PAM_NEW_AUTHTOK_REQD
> > >
> > >What do you think?
> > >
> > >bye,
> > >Sumit
> > >
> > Thanks for comments. Please see attached patches.
> 
> Thank you for your patience. Patches are looking good, working as
> expected and pass CI
> (http://sssd-ci.duckdns.org/logs/job/8/63/summary.html) so ACK.
> 
> Nevertheless I can imagine that there will be request for a 'Password is
> expired' warning for the pwd_expire_policy_warn case (and maybe a syslog
> messages for the pwd_expire_policy_reject case). Would you mind to file
> a ticket about this so that we are prepared?
> 
> bye,
> Sumit

* master:
    * cdaa29d2c5724a4c72bfa0f42284ccfac3d5a464
    * c9b0071bfcb8eb8c71e40248de46d23aceecc0f3 
* sssd-1-12:
    * 8b353dd2b90b7ab222acdea726ab7e8681752237
    * d3f82e944dc5dab3812700a245deec4aa3245b21



More information about the sssd-devel mailing list