From 5fe91dca8b06931a77d2a69c0d6d701b4f32f207 Mon Sep 17 00:00:00 2001 From: Jim Collins Date: Thu, 27 Jun 2013 16:10:44 -0400 Subject: ldap: only update shadowLastChange when password change is successful https://fedorahosted.org/sssd/ticket/1999 ldap_auth.c code which was added to SSSD for updating the shadowLastChange when "ldap_chpass_update_last_change" option is enabled updates shadowLastChange even when the PAM password change status reports failure. We should only update shadowLastChange on PAM password change success or we open up a work around for users to avoid changing their passwords periodically as required by policy. The user simply attempts to change password, fails by trying to set new password which invalid (denied due to password history check) yet shadowLastChange is updated, avoiding their need to actually change the password they are using. --- src/providers/ldap/ldap_auth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c index 58cc2d356..ea28ba66b 100644 --- a/src/providers/ldap/ldap_auth.c +++ b/src/providers/ldap/ldap_auth.c @@ -908,7 +908,8 @@ static void sdap_pam_chpass_done(struct tevent_req *req) } } - if (dp_opt_get_bool(state->ctx->opts->basic, + if (state->pd->pam_status == PAM_SUCCESS && + dp_opt_get_bool(state->ctx->opts->basic, SDAP_CHPASS_UPDATE_LAST_CHANGE)) { lastchanged_name = state->ctx->opts->user_map[SDAP_AT_SP_LSTCHG].name; -- cgit