summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJakub Hrozek <jhrozek@redhat.com>2013-10-08 18:25:20 +0200
committerJakub Hrozek <jhrozek@redhat.com>2013-10-17 13:38:51 +0200
commit2105a6a63cb74bf009fb6e723e74f6ec075e1238 (patch)
tree377e16606c23fbcfbaea6c3c8535aa95fa0ae3cd
parent569bbc59e4060160a986d0fea31601a7b7d998fe (diff)
downloadsssd-2105a6a63cb74bf009fb6e723e74f6ec075e1238.zip
sssd-2105a6a63cb74bf009fb6e723e74f6ec075e1238.tar.gz
sssd-2105a6a63cb74bf009fb6e723e74f6ec075e1238.tar.bz2
KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD userHEADmaster
If an expired AD user logs in, the SSSD receives KRB5KDC_ERR_CLIENT_REVOKED from the KDC. This error code was not handled by the SSSD which resulted in System Error being returned to the PAM stack.
-rw-r--r--src/providers/krb5/krb5_auth.c6
-rw-r--r--src/providers/krb5/krb5_child.c3
2 files changed, 9 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index a4183dc..b4c2057 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -1006,6 +1006,12 @@ static void krb5_auth_done(struct tevent_req *subreq)
ret = EOK;
goto done;
+ case ERR_ACCOUNT_EXPIRED:
+ state->pam_status = PAM_ACCT_EXPIRED;
+ state->dp_err = DP_ERR_OK;
+ ret = EOK;
+ goto done;
+
case ERR_NO_CREDS:
state->pam_status = PAM_CRED_UNAVAIL;
state->dp_err = DP_ERR_OK;
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 24a1fe1..42cfbbf 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -991,6 +991,9 @@ static errno_t map_krb5_error(krb5_error_code kerr)
case KRB5_REALM_CANT_RESOLVE:
return ERR_NETWORK_IO;
+ case KRB5KDC_ERR_CLIENT_REVOKED:
+ return ERR_ACCOUNT_EXPIRED;
+
case KRB5KDC_ERR_KEY_EXP:
return ERR_CREDS_EXPIRED;