Bug 495941

Summary:	pam_succeed_if should match against supplied username, not what some NSS module made out of it
Product:	[Fedora] Fedora	Reporter:	Nils Philippsen <nphilipp>
Component:	pam	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	10	CC:	helge.deller, tmraz, uwe.menges
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pam-1.1.0-1.fc12	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-09-01 15:37:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Nils Philippsen 2009-04-15 16:07:11 UTC

Description of problem:
When attempting to prohibit e.g. logins with a supplied uppercase user name, this won't work with users coming out of ADS because winbindd (via nss_winbind) converts the supplied user name to lower case.

Version-Release number of selected component (if applicable):
pam-1.0.2-2.fc10

How reproducible:
Reproducible

Steps to Reproduce:
1. have a user in ADS, integrated via winbind
2. auth sufficient user !~ [*[A-Z\]*]
3. Try to login via ssh, supplying at least one capital character in the user name
  
Actual results:
Logging in works, "user ... met requirement" in the log

Expected results:
Logging in doesn't work

Additional info: