Bug 1111528
| Summary: | Expired shadow policy user(shadowLastChange=0) is not prompted for password change | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Kaushik Banerjee <kbanerje> |
| Component: | sssd | Assignee: | Jakub Hrozek <jhrozek> |
| Status: | CLOSED ERRATA | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.6 | CC: | apeetham, dpal, grajaiya, jgalipea, kbanerje, lslebodn, mkosek, pbrezina, preichl, tvaughan |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.11.6-25.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1089250 | Environment: | |
| Last Closed: | 2014-10-14 04:48:53 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1089250 | ||
| Bug Blocks: | |||
|
Comment 1
Jakub Hrozek
2014-08-20 14:45:52 UTC
Here is a test build: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7863299 It would be nice if QE could confirm the fix helps. (In reply to Jakub Hrozek from comment #2) > Here is a test build: > http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7863299 > > It would be nice if QE could confirm the fix helps. Works with the scratch build. User is now prompted for the password change. Thanks Jakub. (In reply to Kaushik Banerjee from comment #3) > (In reply to Jakub Hrozek from comment #2) > > Here is a test build: > > http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7863299 > > > > It would be nice if QE could confirm the fix helps. > > Works with the scratch build. User is now prompted for the password change. > Thanks Jakub. Thank you very much for testing. I will build an official package once the patch is merged upstream. Verified with sssd-1.11.6-28.el6 Output from beaker run: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: shadow7: Account expired :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: modifying entry "uid=shadowuser1,ou=Users,dc=example,dc=com" Stopping sssd: [ OK ] Starting sssd: [ OK ] spawn ssh -o StrictHostKeyChecking=no -l shadowuser1 localhost shadowuser1@localhost's password: Password expired. Change your password now. WARNING: Your password has expired. You must change your password now and login again! Changing password for user shadowuser1. Current Password: New password: Retype new password: :: [ LOG ] :: Sleeping for 5 seconds :: [ PASS ] :: File '/var/log/sssd/sssd_LDAP.log' should contain 'Found shadow password expiration attributes' :: [ PASS ] :: File '/var/log/sssd/sssd_LDAP.log' should contain 'Last change day is not set, new password needed' :: [ PASS ] :: File '/var/log/sssd/sssd_LDAP.log' should contain 'Initial authentication for change password operation successful' :: [ LOG ] :: Duration: 9s :: [ LOG ] :: Assertions: 3 good, 0 bad :: [ PASS ] :: RESULT: shadow7: Account expired Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1375.html I know that this is closed, but when performing the test above, did the user have a valid SSH key in LDAP? Is the user still prompted for a password change if they do have a valid SSH key? If they are not, this is a deviation from the way that NSCD has always functioned. Thanks, Trevor |