From d3f82e944dc5dab3812700a245deec4aa3245b21 Mon Sep 17 00:00:00 2001 From: Pavel Reichl Date: Wed, 18 Feb 2015 01:03:40 -0500 Subject: SDAP: enable change phase of pw expire policy check Implement new option which does checking password expiration policy in accounting phase. This allows SSSD to issue shadow expiration warning even if alternate authentication method is used. Resolves: https://fedorahosted.org/sssd/ticket/2167 Reviewed-by: Sumit Bose (cherry picked from commit c9b0071bfcb8eb8c71e40248de46d23aceecc0f3) --- src/providers/ldap/ldap_access.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'src/providers/ldap/ldap_access.c') diff --git a/src/providers/ldap/ldap_access.c b/src/providers/ldap/ldap_access.c index 1913cd9a9..7ebdb20c0 100644 --- a/src/providers/ldap/ldap_access.c +++ b/src/providers/ldap/ldap_access.c @@ -96,6 +96,18 @@ static void sdap_access_done(struct tevent_req *req) case ERR_ACCOUNT_EXPIRED: pam_status = PAM_ACCT_EXPIRED; break; + case ERR_PASSWORD_EXPIRED: + pam_status = PAM_PERM_DENIED; + break; + case ERR_PASSWORD_EXPIRED_REJECT: + pam_status = PAM_PERM_DENIED; + break; + case ERR_PASSWORD_EXPIRED_WARN: + pam_status = PAM_SUCCESS; + break; + case ERR_PASSWORD_EXPIRED_RENEW: + pam_status = PAM_NEW_AUTHTOK_REQD; + break; default: DEBUG(SSSDBG_CRIT_FAILURE, "Error retrieving access check result.\n"); pam_status = PAM_SYSTEM_ERR; -- cgit