Red Hat Bugzilla – Bug 1024744
Improve grace login warning against OpenLDAP server
Last modified: 2015-04-24 07:24:30 EDT
Description of problem: Improve grace login warning against OpenLDAP server Version-Release number of selected component (if applicable): 1.9.2-129 How reproducible: Always Steps to Reproduce: 1. On openldap server, set pwdGraceAuthNLimit to 2 2. Try to auth from another sssd client 1st Attempt: # ssh -l tuuser localhost tuuser@localhost's password: Your password has expired. You have 2 grace login(s) remaining. Last login: Thu Oct 10 14:53:33 2013 from localhost -bash-4.1$ logout 2nd Attempt: # ssh -l tuuser localhost tuuser@localhost's password: Your password has expired. You have 1 grace login(s) remaining. Last login: Thu Oct 10 15:01:01 2013 from localhost -bash-4.1$ logout 3rd Attempt: # ssh -l tuuser localhost tuuser@localhost's password: Password expired. Change your password now. <== Should have shown 0 grace login Last login: Thu Oct 10 15:01:16 2013 from localhost WARNING: Your password has expired. You must change your password now and login again! Changing password for user tuuser. Current Password: Actual results: 3rd attempt shows password expired. Expected results: 3rd attempt against 389-ds server shows 0 grace login remains. There should be consistency against openldap server too. Additional info:
Upstream ticket: https://fedorahosted.org/sssd/ticket/2136
Reproposing to 7.1 as agreed on last Thursday's meeting.
Thank you taking your time and submitting this request for Red Hat Enterprise Linux. Unfortunately, this bug was not given a priority and was deferred both in the upstream project and in Red Hat Enterprise Linux. Given that we are unable to fulfill this request in following Red Hat Enterprise Linux releases, I am closing the Bugzilla as DEFERRED. To request that Red Hat re-considers the decision, please re-open the Bugzilla via appropriate support channels and provide additional business and/or technical details about its importance to you. Note that you can still track this request or even contribute patches in the referred upstream Trac ticket.