[SSSD] [PATCHES] SDAP: Lock out ssh keys when account naturally expires

Pavel Reichl preichl at redhat.com
Thu Mar 5 13:34:15 UTC 2015



On 03/05/2015 02:15 PM, Pavel Reichl wrote:
> +    case PWP_LOCKOUT_EXPIRE:
> +        /* Account may be locked out from natural reasons (too many attempts,
> +         * expired password). In this case, pwdAccountLockedTime is also set,
> +         * to the time of lock out.
> +         */
> +        ret = sss_utc_to_time_t(pwdAccountLockedTime, "%Y%m%d%H%M%SZ",
> +                                &lock_time);
> +        if (ret != EOK) {
> +            DEBUG(SSSDBG_TRACE_FUNC, "sss_utc_to_time_t failed with %d:%s.\n",
> +                  ret, sss_strerror(ret));
> +            goto done;
> +        }
> +
> +        now = time(NULL);
> +
> +        /* Account was NOT locked in past. */
> +        if (difftime(lock_time, now) > 0.0) {
> +            locked = false;
> +        } else if (pwdAccountLockedDurationTime != NULL) {
> +            errno = 0;
> +            duration = strtouint32(pwdAccountLockedDurationTime, NULL, 0);
> +            if (errno) {
> +                ret = errno;
> +                goto done;
> +            }
> +            /* Lockout has expired */
> +            if (duration != 0 && difftime(now, lock_time) > duration) {
> +                locked = false;
> +            }
> +        }
> +        break;
> +    case PWP_SENTINEL:
> +    default:
> +        DEBUG(SSSDBG_MINOR_FAILURE,
> +              "Unexpected value of password policy mode: %d.\n", pwpol_mode);
I guess it would be better to set 'ret = EINVAL;' here
> +    }
> +
> +    ret = EOK




More information about the sssd-devel mailing list