Bug 12725 - PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain
PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain
Status: RESOLVED FIXED
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind
4.5.5
All All
: P5 normal
: ---
Assigned To: Karolin Seeger
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-03-28 21:04 UTC by Christof Schmitt
Modified: 2017-04-28 07:05 UTC (History)
3 users (show)

See Also:


Attachments
backport to 4.5 (1.69 KB, patch)
2017-03-29 21:56 UTC, Christof Schmitt
asn: review+
Details
backport to 4.6 (1.69 KB, patch)
2017-03-29 21:56 UTC, Christof Schmitt
asn: review+
Details
Additional patch for v4-6-test (6.53 KB, patch)
2017-04-06 12:09 UTC, Stefan Metzmacher
asn: review+
cs: review+
Details
Additional patch for v4-5-test (6.53 KB, patch)
2017-04-06 12:10 UTC, Stefan Metzmacher
asn: review+
cs: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Christof Schmitt 2017-03-28 21:04:42 UTC
A PAM_AUTH request is sent to the DC in the joined domain. If the
authentication request was for a user from a trusted domain, and the
flag WBFLAG_PAM_GET_PWD_POLICY is specified then the password
policy from the joined domain is queried and returned.

In case the PAM_AUTH request has been issued from the pam_winbind
module that can lead to a wrong password expiration warning in pam_winbind,
if the password of the users would be expired according the the joined
domain policy, but it is not expired with the policy of the trusted domain.
Comment 1 Christof Schmitt 2017-03-29 21:56:14 UTC
Created attachment 13122 [details]
backport to 4.5
Comment 2 Christof Schmitt 2017-03-29 21:56:38 UTC
Created attachment 13123 [details]
backport to 4.6
Comment 3 Andreas Schneider 2017-03-30 06:33:55 UTC
Comment on attachment 13122 [details]
backport to 4.5

Karolin, please add the patches to the relevant branches. Thanks.
Comment 4 Karolin Seeger 2017-03-31 08:26:30 UTC
(In reply to Andreas Schneider from comment #3)
Pushed to autobuild-v4-{6,5}-test.
Comment 5 Stefan Metzmacher 2017-04-06 12:09:31 UTC
Created attachment 13135 [details]
Additional patch for v4-6-test
Comment 6 Stefan Metzmacher 2017-04-06 12:10:06 UTC
Created attachment 13136 [details]
Additional patch for v4-5-test
Comment 7 Andreas Schneider 2017-04-07 13:05:52 UTC
Karolin, please add the addtional patches too. Thanks.
Comment 8 Karolin Seeger 2017-04-21 07:05:45 UTC
(In reply to Andreas Schneider from comment #7)
Pushed additional patches to autobuild-v4-{6,5}-test.
Comment 9 Karolin Seeger 2017-04-28 07:05:43 UTC
(In reply to Karolin Seeger from comment #8)
Pushed to both branches.
Closing out bug report.

Thanks!