Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ldap: update shadow last change in sysdb as well #6478

Closed
wants to merge 1 commit into from
Closed

ldap: update shadow last change in sysdb as well #6478

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/db/sysdb.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1061,6 +1061,10 @@ int sysdb_set_user_attr(struct sss_domain_info *domain,
struct sysdb_attrs *attrs,
int mod_op);

errno_t sysdb_update_user_shadow_last_change(struct sss_domain_info *domain,
const char *name,
const char *attrname);

/* Replace group attrs */
int sysdb_set_group_attr(struct sss_domain_info *domain,
const char *name,
Expand Down
32 changes: 32 additions & 0 deletions src/db/sysdb_ops.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1485,6 +1485,38 @@ int sysdb_set_user_attr(struct sss_domain_info *domain,
return ret;
}

errno_t sysdb_update_user_shadow_last_change(struct sss_domain_info *domain,
const char *name,
const char *attrname)
{
struct sysdb_attrs *attrs;
char *value;
errno_t ret;

attrs = sysdb_new_attrs(NULL);
if (attrs == NULL) {
return ENOMEM;
}

/* The attribute contains number of days since the epoch */
value = talloc_asprintf(attrs, "%ld", (long)time(NULL)/86400);
if (value == NULL) {
ret = ENOMEM;
goto done;
}

ret = sysdb_attrs_add_string(attrs, attrname, value);
if (ret != EOK) {
goto done;
}

ret = sysdb_set_user_attr(domain, name, attrs, SYSDB_MOD_REP);

done:
talloc_free(attrs);
return ret;
}

/* =Replace-Attributes-On-Group=========================================== */

int sysdb_set_group_attr(struct sss_domain_info *domain,
Expand Down
21 changes: 16 additions & 5 deletions src/providers/ldap/ldap_auth.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1240,6 +1240,7 @@ struct sdap_pam_chpass_handler_state {
struct pam_data *pd;
struct sdap_handle *sh;
char *dn;
enum pwexpire pw_expire_type;
};

static void sdap_pam_chpass_handler_auth_done(struct tevent_req *subreq);
Expand Down Expand Up @@ -1339,7 +1340,6 @@ static void sdap_pam_chpass_handler_auth_done(struct tevent_req *subreq)
{
struct sdap_pam_chpass_handler_state *state;
struct tevent_req *req;
enum pwexpire pw_expire_type;
void *pw_expire_data;
size_t msg_len;
uint8_t *msg;
Expand All @@ -1349,7 +1349,7 @@ static void sdap_pam_chpass_handler_auth_done(struct tevent_req *subreq)
state = tevent_req_data(req, struct sdap_pam_chpass_handler_state);

ret = auth_recv(subreq, state, &state->sh, &state->dn,
&pw_expire_type, &pw_expire_data);
&state->pw_expire_type, &pw_expire_data);
talloc_free(subreq);

if ((ret == EOK || ret == ERR_PASSWORD_EXPIRED) &&
Expand All @@ -1361,7 +1361,7 @@ static void sdap_pam_chpass_handler_auth_done(struct tevent_req *subreq)
}

if (ret == EOK) {
switch (pw_expire_type) {
switch (state->pw_expire_type) {
case PWEXPIRE_SHADOW:
ret = check_pwexpire_shadow(pw_expire_data, time(NULL), NULL);
break;
Expand All @@ -1381,7 +1381,8 @@ static void sdap_pam_chpass_handler_auth_done(struct tevent_req *subreq)
break;
default:
DEBUG(SSSDBG_CRIT_FAILURE,
"Unknown password expiration type %d.\n", pw_expire_type);
"Unknown password expiration type %d.\n",
state->pw_expire_type);
state->pd->pam_status = PAM_SYSTEM_ERR;
goto done;
}
Expand All @@ -1392,7 +1393,8 @@ static void sdap_pam_chpass_handler_auth_done(struct tevent_req *subreq)
case ERR_PASSWORD_EXPIRED:
DEBUG(SSSDBG_TRACE_LIBS,
"user [%s] successfully authenticated.\n", state->dn);
ret = sdap_pam_chpass_handler_change_step(state, req, pw_expire_type);
ret = sdap_pam_chpass_handler_change_step(state, req,
state->pw_expire_type);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE,
"sdap_pam_chpass_handler_change_step() failed.\n");
Expand Down Expand Up @@ -1506,6 +1508,15 @@ static void sdap_pam_chpass_handler_chpass_done(struct tevent_req *subreq)

switch (ret) {
case EOK:
if (state->pw_expire_type == PWEXPIRE_SHADOW) {
ret = sysdb_update_user_shadow_last_change(state->be_ctx->domain,
state->pd->user, SYSDB_SHADOWPW_LASTCHANGE);
if (ret != EOK) {
state->pd->pam_status = PAM_SYSTEM_ERR;
goto done;
}
}

state->pd->pam_status = PAM_SUCCESS;
break;
case ERR_CHPASS_DENIED:
Expand Down