Hi,
the attached patch fixes #2271. Kindly see the patch and the commit message for more details.
I tested password change w/o OTPs to make sure we don't regress and also with TOTP. I tested both expired passwords and password change via PAM. HOTP currently doesn't work because of another bug.
The patch looks okay to me. There is however, a spelling error in the commit message: "attemtp".
----- Original Message -----
Hi,
the attached patch fixes #2271. Kindly see the patch and the commit message for more details.
I tested password change w/o OTPs to make sure we don't regress and also with TOTP. I tested both expired passwords and password change via PAM. HOTP currently doesn't work because of another bug.
On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
The patch looks okay to me. There is however, a spelling error in the commit message: "attemtp".
Nice catch. A new patch (which only differs in the commit message) is attached.
One more respin -- this time, if there was no ccache with this user's principal after the chpass, we print a warning message telling the user to log out and back in. Would you prefer if the message was printed every time an OTP password is changed even though the user might posses a valid TGT?
If you'd like me to build you a test package for easier testing.
On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
The patch looks okay to me. There is however, a spelling error in the commit message: "attemtp".
Nice catch. A new patch (which only differs in the commit message) is attached.
One more respin -- this time, if there was no ccache with this user's principal after the chpass, we print a warning message telling the user to log out and back in. Would you prefer if the message was printed every time an OTP password is changed even though the user might posses a valid TGT?
If you'd like me to build you a test package for easier testing.
Yet one more change, this time only in a DEBUG message. For convenience, attached is also a version that applies cleanly on top of sssd-1-11 and can be used to patch Fedora or RHEL7 packages.
Alexander or Nathaniel, will you have some time to review the patch today? I'm away next week and would like to get this issue off the table before I leave.
On Fri, 2014-03-21 at 16:00 +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
The patch looks okay to me. There is however, a spelling error in the commit message: "attemtp".
Nice catch. A new patch (which only differs in the commit message) is attached.
One more respin -- this time, if there was no ccache with this user's principal after the chpass, we print a warning message telling the user to log out and back in. Would you prefer if the message was printed every time an OTP password is changed even though the user might posses a valid TGT?
If you'd like me to build you a test package for easier testing.
Yet one more change, this time only in a DEBUG message. For convenience, attached is also a version that applies cleanly on top of sssd-1-11 and can be used to patch Fedora or RHEL7 packages.
Alexander or Nathaniel, will you have some time to review the patch today? I'm away next week and would like to get this issue off the table before I leave.
Here is the patch rebased on top of Sumit's recent krb5 opt patches.
Both patches for master and 1.11 are attached.
On Sat, 22 Mar 2014, Jakub Hrozek wrote:
On Fri, 2014-03-21 at 16:00 +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
The patch looks okay to me. There is however, a spelling error in the commit message: "attemtp".
Nice catch. A new patch (which only differs in the commit message) is attached.
One more respin -- this time, if there was no ccache with this user's principal after the chpass, we print a warning message telling the user to log out and back in. Would you prefer if the message was printed every time an OTP password is changed even though the user might posses a valid TGT?
If you'd like me to build you a test package for easier testing.
Yet one more change, this time only in a DEBUG message. For convenience, attached is also a version that applies cleanly on top of sssd-1-11 and can be used to patch Fedora or RHEL7 packages.
Alexander or Nathaniel, will you have some time to review the patch today? I'm away next week and would like to get this issue off the table before I leave.
Here is the patch rebased on top of Sumit's recent krb5 opt patches.
Both patches for master and 1.11 are attached.
ACK.
I've tested the version for master branch. Changing password worked fine for OTP case. Now the only change we miss is in FreeIPA code where changing password with OTP does not work in WebUI...
On Sun, 23 Mar 2014, Alexander Bokovoy wrote:
On Sat, 22 Mar 2014, Jakub Hrozek wrote:
On Fri, 2014-03-21 at 16:00 +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
The patch looks okay to me. There is however, a spelling error in the commit message: "attemtp".
Nice catch. A new patch (which only differs in the commit message) is attached.
One more respin -- this time, if there was no ccache with this user's principal after the chpass, we print a warning message telling the user to log out and back in. Would you prefer if the message was printed every time an OTP password is changed even though the user might posses a valid TGT?
If you'd like me to build you a test package for easier testing.
Yet one more change, this time only in a DEBUG message. For convenience, attached is also a version that applies cleanly on top of sssd-1-11 and can be used to patch Fedora or RHEL7 packages.
Alexander or Nathaniel, will you have some time to review the patch today? I'm away next week and would like to get this issue off the table before I leave.
Here is the patch rebased on top of Sumit's recent krb5 opt patches.
Both patches for master and 1.11 are attached.
ACK.
I've tested the version for master branch. Changing password worked fine for OTP case. Now the only change we miss is in FreeIPA code where changing password with OTP does not work in WebUI...
BTW, for those who want to test OTP, I have updated my COPR repo based on git master versions of SSSD and FreeIPA for Fedora 20 x86_64 (and few outstanding patches, like this one).
http://copr.fedoraproject.org/coprs/abbra/freeipa-otp-unstable/
On Sun, Mar 23, 2014 at 11:13:58PM +0200, Alexander Bokovoy wrote:
On Sat, 22 Mar 2014, Jakub Hrozek wrote:
On Fri, 2014-03-21 at 16:00 +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 08:09:45PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 06:20:41PM +0100, Jakub Hrozek wrote:
On Tue, Mar 18, 2014 at 01:14:45PM -0400, Nathaniel McCallum wrote:
The patch looks okay to me. There is however, a spelling error in the commit message: "attemtp".
Nice catch. A new patch (which only differs in the commit message) is attached.
One more respin -- this time, if there was no ccache with this user's principal after the chpass, we print a warning message telling the user to log out and back in. Would you prefer if the message was printed every time an OTP password is changed even though the user might posses a valid TGT?
If you'd like me to build you a test package for easier testing.
Yet one more change, this time only in a DEBUG message. For convenience, attached is also a version that applies cleanly on top of sssd-1-11 and can be used to patch Fedora or RHEL7 packages.
Alexander or Nathaniel, will you have some time to review the patch today? I'm away next week and would like to get this issue off the table before I leave.
Here is the patch rebased on top of Sumit's recent krb5 opt patches.
Both patches for master and 1.11 are attached.
ACK.
I've tested the version for master branch. Changing password worked fine for OTP case. Now the only change we miss is in FreeIPA code where changing password with OTP does not work in WebUI...
Pushed to
master: 3983d81f461a4f17736a516eb595f54df4bf4336 sssd-1-11: 1c1693ee1a74f27caaef416d9dce5c14b0ad53f9
bye, Sumit
-- / Alexander Bokovoy _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
sssd-devel@lists.fedorahosted.org
-
Alexander Bokovoy -
Jakub Hrozek -
Jakub Hrozek -
Nathaniel McCallum -
Sumit Bose