On Tue, Jan 22, 2013 at 11:11:51AM +0100, Sumit Bose wrote: > On Tue, Jan 22, 2013 at 09:35:18AM +0100, Jakub Hrozek wrote: > > On Sat, Jan 19, 2013 at 07:19:38PM +0100, Jakub Hrozek wrote: > > > https://fedorahosted.org/sssd/ticket/1773 > > > > > > Commit bf8cce77a35cb0a3cdb0d21fb9c39b7b6372bc11 broke > > > pam_pwd_expiration_warning because it started treating its value as if > > > it was seconds, but in fact it's days. > > > > > > I tested the path that hits parse_krb5_child_response() and the one that > > > goes through check_pwexpire_ldap() but I'm not entirely sure how to test > > > the LDAP authentication that uses check_pwexpire_kerberos(). Could > > > anyone educate me (or test the patch as part of review maybe?). > > > > > > I also don't like that the Kerberos password expiration is checked in > > > the provider and the LDAP password expiration in the responder. I think > > > this kind of logic belongs to the responder only. I filed #1774 to get > > > it fixed, but since this patch is intended for the 1.9.4 release that is > > > going to happen after Wednesday, I think we can do the refactor > > > separately. > > > > This patch was wrong and Sumit nacked it on IRC. It is enough to convert > > the values coming from the [pam] section to seconds. > > ACK, I tested this patch with pwd_expiration_warning and > pam_pwd_expiration_warning and both are working as expected now. I used > check_pwexpire_kerberos() for testing. This method was introduced to > allow to use FreeIPA as a pure LDAP server with LDAP authentication. > Here is expiration time is stored krbPasswordExpiration attribute. > > bye, > Sumit
Pushed to master and sssd-1-9 (Sorry, late pushmail. I thought I already sent it) _______________________________________________ sssd-devel mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
