diff options
Diffstat (limited to 'daemons/ipa-kdb/ipa_kdb_principals.c')
-rw-r--r-- | daemons/ipa-kdb/ipa_kdb_principals.c | 28 |
1 files changed, 24 insertions, 4 deletions
diff --git a/daemons/ipa-kdb/ipa_kdb_principals.c b/daemons/ipa-kdb/ipa_kdb_principals.c index 8e1d42185..ed5195fb9 100644 --- a/daemons/ipa-kdb/ipa_kdb_principals.c +++ b/daemons/ipa-kdb/ipa_kdb_principals.c @@ -1362,7 +1362,8 @@ done: return kerr; } -static krb5_error_code ipadb_entry_to_mods(struct ipadb_mods *imods, +static krb5_error_code ipadb_entry_to_mods(krb5_context kcontext, + struct ipadb_mods *imods, krb5_db_entry *entry, char *principal, int mod_op) @@ -1561,10 +1562,11 @@ static krb5_error_code ipadb_entry_to_mods(struct ipadb_mods *imods, /* KADM5_LOAD */ - /* Store saved password if any and password history */ + /* Handle password change related operations. */ if (entry->e_data) { struct ipadb_e_data *ied; time_t now = time(NULL); + time_t expire_time; char **new_history; int nh_len; int ret; @@ -1603,6 +1605,22 @@ static krb5_error_code ipadb_entry_to_mods(struct ipadb_mods *imods, goto done; } } + + /* Also set new password expiration time. + * Have to do it here because kadmin doesn't know policies and resets + * entry->mask after we have gone through the password change code. + */ + kerr = ipadb_get_pwd_expiration(kcontext, entry, ied, &expire_time); + if (kerr) { + goto done; + } + + kerr = ipadb_get_ldap_mod_time(imods, + "krbPasswordExpiration", + expire_time, mod_op); + if (kerr) { + goto done; + } } kerr = 0; @@ -1689,7 +1707,8 @@ static krb5_error_code ipadb_add_principal(krb5_context kcontext, goto done; } - kerr = ipadb_entry_to_mods(imods, entry, principal, LDAP_MOD_ADD); + kerr = ipadb_entry_to_mods(kcontext, imods, + entry, principal, LDAP_MOD_ADD); if (kerr != 0) { goto done; } @@ -1752,7 +1771,8 @@ static krb5_error_code ipadb_modify_principal(krb5_context kcontext, goto done; } - kerr = ipadb_entry_to_mods(imods, entry, principal, LDAP_MOD_REPLACE); + kerr = ipadb_entry_to_mods(kcontext, imods, + entry, principal, LDAP_MOD_REPLACE); if (kerr != 0) { goto done; } |