[PATCH] Check for expired passwords in LDAP provider

[Sumit Bose]

Hi,

with this patch the LDAP provider check typical attributes which
determines the lifetime of a password. If there is more than one scheme
available the following order is user:
 - server side password policies
 - Kerberos password attributes
 - shadow attributes
Currently only in the case of server side password policies the password
can actually be changed. Kerberos password should be changed with the
Kerberos backend.

bye,
Sumit

[Simo Sorce]

On Fri, 2009-10-09 at 21:38 +0200, Sumit Bose wrote:
>  Hi,
>  
>  with this patch the LDAP provider check typical attributes which
>  determines the lifetime of a password. If there is more than one scheme
>  available the following order is user:
>   - server side password policies
>   - Kerberos password attributes
>   - shadow attributes
>  Currently only in the case of server side password policies the password
>  can actually be changed. Kerberos password should be changed with the
>  Kerberos backend. 
The patch seem mostly ok, I have tried it against a freeipa server (so
haven't tested shadow or password control), and found a problem.

The kerberos expiration time is read as it was in local time. It is not
it is in UTC. This prevented the code from detecting as expired an
account the was just expired, as it thought, wrongly, that the
expiration time was 5 hours in the future (I am GMT-5 here).

I think the shadow time checks may have a similar problem, but they use
a different method to test for expiration so I am not entirely sure,
please check that too.

So NACK until this is fixed.

Patch also need to be rebased as option definitions have been moved to
ldap_common.c

Simo.


-- 
Simo Sorce * Red Hat, Inc * New York

[Sumit Bose]

On Wed, Oct 14, 2009 at 07:45:46PM -0400, Simo Sorce wrote:
>  On Fri, 2009-10-09 at 21:38 +0200, Sumit Bose wrote:
>  > Hi,
>  > 
>  > with this patch the LDAP provider check typical attributes which
>  > determines the lifetime of a password. If there is more than one scheme
>  > available the following order is user:
>  >  - server side password policies
>  >  - Kerberos password attributes
>  >  - shadow attributes
>  > Currently only in the case of server side password policies the password
>  > can actually be changed. Kerberos password should be changed with the
>  > Kerberos backend.
>  
>  The patch seem mostly ok, I have tried it against a freeipa server (so
>  haven't tested shadow or password control), and found a problem.
>  
>  The kerberos expiration time is read as it was in local time. It is not
>  it is in UTC. This prevented the code from detecting as expired an
>  account the was just expired, as it thought, wrongly, that the
>  expiration time was 5 hours in the future (I am GMT-5 here). 
fixed

>  
>  I think the shadow time checks may have a similar problem, but they use
>  a different method to test for expiration so I am not entirely sure,
>  please check that too. 
I have adopted the calulations from pam_unix so it should be safe.

>  
>  So NACK until this is fixed.
>  
>  Patch also need to be rebased as option definitions have been moved to
>  ldap_common.c 
done, new version attached.

>  
>  Simo.
>   
bye,
Sumit

[Simo Sorce]

On Thu, 2009-10-15 at 14:20 +0200, Sumit Bose wrote:
>  On Wed, Oct 14, 2009 at 07:45:46PM -0400, Simo Sorce wrote:
>  > On Fri, 2009-10-09 at 21:38 +0200, Sumit Bose wrote:
>  > > Hi,
>  > > 
>  > > with this patch the LDAP provider check typical attributes which
>  > > determines the lifetime of a password. If there is more than one scheme
>  > > available the following order is user:
>  > >  - server side password policies
>  > >  - Kerberos password attributes
>  > >  - shadow attributes
>  > > Currently only in the case of server side password policies the password
>  > > can actually be changed. Kerberos password should be changed with the
>  > > Kerberos backend.
>  > 
>  > The patch seem mostly ok, I have tried it against a freeipa server (so
>  > haven't tested shadow or password control), and found a problem.
>  > 
>  > The kerberos expiration time is read as it was in local time. It is not
>  > it is in UTC. This prevented the code from detecting as expired an
>  > account the was just expired, as it thought, wrongly, that the
>  > expiration time was 5 hours in the future (I am GMT-5 here).
>  
>  fixed
>  
>  > 
>  > I think the shadow time checks may have a similar problem, but they use
>  > a different method to test for expiration so I am not entirely sure,
>  > please check that too.
>  
>  I have adopted the calulations from pam_unix so it should be safe.
>  
>  > 
>  > So NACK until this is fixed.
>  > 
>  > Patch also need to be rebased as option definitions have been moved to
>  > ldap_common.c
>  
>  done, new version attached. 
Ok I rebased the patch to apply against the latest master.
Acked and pushed.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York