summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-07-27 10:15:00 -0400
committerMartin Kosek <mkosek@redhat.com>2011-07-29 10:27:15 +0200
commit1ebe3c1d12e8694baa00c713a60122a40a0c51a3 (patch)
tree552f2be8dd0e15795167bbf89678873a54e8bae5
parent51cd0c916b7f97a249abe17a2987b5ec849bf723 (diff)
downloadfreeipa-1ebe3c1d12e8694baa00c713a60122a40a0c51a3.zip
freeipa-1ebe3c1d12e8694baa00c713a60122a40a0c51a3.tar.gz
freeipa-1ebe3c1d12e8694baa00c713a60122a40a0c51a3.tar.xz
When setting a host password don't set krbPasswordExpiration.
This can cause problems if a host is enrolled, unenrolled and a password set. The password will be marked as expired like all new passwords are. https://fedorahosted.org/freeipa/ticket/1526
-rw-r--r--daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c20
1 files changed, 12 insertions, 8 deletions
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c
index caca0fc..ebefad6 100644
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c
@@ -855,14 +855,14 @@ static int ipapwd_post_op(Slapi_PBlock *pb)
LOG_FATAL("failed to parse expiration date (buggy gmtime_r ?)\n");
goto done;
}
- strftime(timestr, GENERALIZED_TIME_LENGTH+1,
- "%Y%m%d%H%M%SZ", &utctime);
- slapi_mods_add_string(smods, LDAP_MOD_REPLACE,
- "krbPasswordExpiration", timestr);
-
- /* Don't set a last password change password on host passwords. This
- * attribute is used to tell whether we have a valid keytab. If we
- * set it on userPassword it confuses enrollment.
+
+ /* Don't set a last password change or expiration on host passwords.
+ * krbLastPwdChange is used to tell whether we have a valid keytab. If we
+ * set it on userPassword it confuses enrollment. If krbPasswordExpiration
+ * is set on a host entry then the keytab will appear to be expired.
+ *
+ * When a host is issued a keytab these attributes get set properly by
+ * ipapwd_setkeytab().
*/
ipahost = slapi_value_new_string("ipaHost");
if (!pwdop->pwdata.target || (slapi_entry_attr_has_syntax_value(pwdop->pwdata.target, SLAPI_ATTR_OBJECTCLASS, ipahost)) == 0) {
@@ -876,6 +876,10 @@ static int ipapwd_post_op(Slapi_PBlock *pb)
"%Y%m%d%H%M%SZ", &utctime);
slapi_mods_add_string(smods, LDAP_MOD_REPLACE,
"krbLastPwdChange", timestr);
+ strftime(timestr, GENERALIZED_TIME_LENGTH+1,
+ "%Y%m%d%H%M%SZ", &utctime);
+ slapi_mods_add_string(smods, LDAP_MOD_REPLACE,
+ "krbPasswordExpiration", timestr);
}
slapi_value_free(&ipahost);