[SSSD] [PATCHES] SDAP: Lock out ssh keys when account naturally expires
Pavel Reichl
preichl at redhat.com
Thu Mar 5 13:34:15 UTC 2015
On 03/05/2015 02:15 PM, Pavel Reichl wrote:
> + case PWP_LOCKOUT_EXPIRE:
> + /* Account may be locked out from natural reasons (too many attempts,
> + * expired password). In this case, pwdAccountLockedTime is also set,
> + * to the time of lock out.
> + */
> + ret = sss_utc_to_time_t(pwdAccountLockedTime, "%Y%m%d%H%M%SZ",
> + &lock_time);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_TRACE_FUNC, "sss_utc_to_time_t failed with %d:%s.\n",
> + ret, sss_strerror(ret));
> + goto done;
> + }
> +
> + now = time(NULL);
> +
> + /* Account was NOT locked in past. */
> + if (difftime(lock_time, now) > 0.0) {
> + locked = false;
> + } else if (pwdAccountLockedDurationTime != NULL) {
> + errno = 0;
> + duration = strtouint32(pwdAccountLockedDurationTime, NULL, 0);
> + if (errno) {
> + ret = errno;
> + goto done;
> + }
> + /* Lockout has expired */
> + if (duration != 0 && difftime(now, lock_time) > duration) {
> + locked = false;
> + }
> + }
> + break;
> + case PWP_SENTINEL:
> + default:
> + DEBUG(SSSDBG_MINOR_FAILURE,
> + "Unexpected value of password policy mode: %d.\n", pwpol_mode);
I guess it would be better to set 'ret = EINVAL;' here
> + }
> +
> + ret = EOK
More information about the sssd-devel
mailing list