diff options
| author | Ralf Haferkamp <rhafer@suse.de> | 2010-03-12 15:06:44 +0100 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2010-03-15 08:15:23 -0400 |
| commit | 5f92a563ea89f4fb82401168cf65fff4b85124cc (patch) | |
| tree | d9671c5872489d739a034abb3e5e7bf4cc5a981c | |
| parent | 8cbcfe11709534bcedbf7bf53358b6fa925df861 (diff) | |
| download | sssd-5f92a563ea89f4fb82401168cf65fff4b85124cc.tar.gz sssd-5f92a563ea89f4fb82401168cf65fff4b85124cc.tar.xz sssd-5f92a563ea89f4fb82401168cf65fff4b85124cc.zip | |
Fixed check for expired passwords
When the user's password is expired it might also be indicated by
the bind operation returning "INVALID_CREDENTIALS" with the ppolicy
control's errorcode set to "PP_passwordExpired".
| -rw-r--r-- | src/providers/ldap/sdap_async_connection.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c index 18e47d3b7..fe8a50182 100644 --- a/src/providers/ldap/sdap_async_connection.c +++ b/src/providers/ldap/sdap_async_connection.c @@ -421,8 +421,10 @@ static void simple_bind_done(struct sdap_op *op, "error [%s].\n", pp_expire, pp_grace, ldap_passwordpolicy_err2txt(pp_error))); - if (state->result == LDAP_SUCCESS && - (pp_error == PP_changeAfterReset || pp_grace > 0)) { + if ((state->result == LDAP_SUCCESS && + (pp_error == PP_changeAfterReset || pp_grace > 0)) || + (state->result == LDAP_INVALID_CREDENTIALS && + pp_error == PP_passwordExpired ) ) { DEBUG(4, ("User must set a new password.\n")); state->result = LDAP_X_SSSD_PASSWORD_EXPIRED; } |