diff options
| author | Jim Collins <github@collins-fam.com> | 2013-06-27 16:10:44 -0400 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2013-07-01 09:14:50 -0400 |
| commit | 5fe91dca8b06931a77d2a69c0d6d701b4f32f207 (patch) | |
| tree | dec8946a315f892aec5d075304f6a4d2f480b364 | |
| parent | 05b500191fd0e2a20c97cd69a4a084dd372a2ebb (diff) | |
| download | sssd-5fe91dca8b06931a77d2a69c0d6d701b4f32f207.tar.gz sssd-5fe91dca8b06931a77d2a69c0d6d701b4f32f207.tar.xz sssd-5fe91dca8b06931a77d2a69c0d6d701b4f32f207.zip | |
ldap: only update shadowLastChange when password change is successful
https://fedorahosted.org/sssd/ticket/1999
ldap_auth.c code which was added to SSSD for updating the
shadowLastChange when "ldap_chpass_update_last_change" option is
enabled updates shadowLastChange even when the PAM password change
status reports failure.
We should only update shadowLastChange on PAM password change success or
we open up a work around for users to avoid changing their passwords
periodically as required by policy. The user simply attempts to change
password, fails by trying to set new password which invalid (denied due
to password history check) yet shadowLastChange is updated, avoiding
their need to actually change the password they are using.
| -rw-r--r-- | src/providers/ldap/ldap_auth.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c index 58cc2d356..ea28ba66b 100644 --- a/src/providers/ldap/ldap_auth.c +++ b/src/providers/ldap/ldap_auth.c @@ -908,7 +908,8 @@ static void sdap_pam_chpass_done(struct tevent_req *req) } } - if (dp_opt_get_bool(state->ctx->opts->basic, + if (state->pd->pam_status == PAM_SUCCESS && + dp_opt_get_bool(state->ctx->opts->basic, SDAP_CHPASS_UPDATE_LAST_CHANGE)) { lastchanged_name = state->ctx->opts->user_map[SDAP_AT_SP_LSTCHG].name; |