[SSSD-users] Need help configuring fine grained password policy

Jakub Hrozek jhrozek at redhat.com
Fri Sep 13 11:17:45 UTC 2013


On Thu, Sep 12, 2013 at 03:21:51PM -0400, Dmitri Pal wrote:
> On 09/12/2013 03:14 PM, Bright, Daniel wrote:
> >
> > Jakub,
> >
> >  
> >
> > Thanks for the response, I figured out why I was getting the
> > constraint violation, in my case it was because I have the
> > “passwordminage” set for my policy, when I changed the user attribute
> > “passwordallowchangetime” to the current date then I was able to
> > perform the passwd operation. So at this point I believe the password
> > policy is being applied, however I am just not getting all of the
> > responses I would like, I get things like “password is too short”,
> > “your password will expire in X days”, but I would expect to get
> > something like “You cannot change your password again for X days” from
> > the above
> >
> >  
> >
> > This leads me to another question, is there a way I can map certain
> > responses to responses that I define?
> >
> 
> The responses are related to error codes that the server returns. I do
> not think you can define them unless the DS you use allows you to.
> In SSSD you definitely can't. We just propagate what we got from the
> server to the user. There was a bug in that area that has been fixed
> recently as Jakub mentioned earlier.
> 
> https://fedorahosted.org/sssd/ticket/1827

Exactly. Did you maybe see some extended error message coming from the
server in the debug logs? If yes, then we could pass that on, maybe
based on pam_verbosity setting.


More information about the sssd-users mailing list