Blob Blame Raw
From 3ab8a78cd27cc8d2ad7a2b322a4fe73c43a3db08 Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Thu, 14 Sep 2017 15:47:53 -0400
Subject: [PATCH] Ticket 49327 - password expired control not sent during grace
 logins

Bug Description:  When a password is expired, but within the grace login limit,
                  we should still send the expired control even though we allowed
                  the bind.

Fix Description:  new_new_passwd() returned a variety of result codes that required
                  the caller to set the response controls.  This was hard to read and
                  process.  Instead I added all the controls inside the function, and
                  return success or failure to the caller.

https://pagure.io/389-ds-base/issue/49327

Reviewed by: gparente & tbordaz (Thanks!!)

(cherry picked from commit fbd32c4e27af9f331ee3a42dec944895a6efe2ad)
---
 ldap/servers/plugins/replication/repl_extop.c |   5 +-
 ldap/servers/slapd/bind.c                     |  18 +-
 ldap/servers/slapd/proto-slap.h               |   3 +-
 ldap/servers/slapd/pw_mgmt.c                  | 453 +++++++++++++-------------
 ldap/servers/slapd/saslbind.c                 |  20 +-
 5 files changed, 238 insertions(+), 261 deletions(-)

diff --git a/ldap/servers/plugins/replication/repl_extop.c b/ldap/servers/plugins/replication/repl_extop.c
index a39d918..96ad7dd 100644
--- a/ldap/servers/plugins/replication/repl_extop.c
+++ b/ldap/servers/plugins/replication/repl_extop.c
@@ -1173,8 +1173,9 @@ send_response:
 			 * On the supplier, we need to close the connection so
 			 * that the RA will restart a new session in a clear state 
 			 */
-			slapi_log_err(SLAPI_LOG_REPL, repl_plugin_name, "multimaster_extop_StartNSDS50ReplicationRequest - "
-				"already acquired replica: disconnect conn=%d\n", connid);
+			slapi_log_err(SLAPI_LOG_REPL, repl_plugin_name, 
+			              "multimaster_extop_StartNSDS50ReplicationRequest - "
+			              "already acquired replica: disconnect conn=%" PRIu64 "\n", connid);
 			slapi_disconnect_server(conn);
             
 		}
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index d6c7668..e6cad7f 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -673,8 +673,7 @@ do_bind( Slapi_PBlock *pb )
             slapi_entry_free(referral);
             goto free_and_return;
         } else if (auto_bind || rc == SLAPI_BIND_SUCCESS || rc == SLAPI_BIND_ANONYMOUS) {
-            long t;
-            char* authtype = NULL;
+            char *authtype = NULL;
             /* rc is SLAPI_BIND_SUCCESS or SLAPI_BIND_ANONYMOUS */
             if(auto_bind) {
                 rc = SLAPI_BIND_SUCCESS;
@@ -761,19 +760,8 @@ do_bind( Slapi_PBlock *pb )
                                          slapi_ch_strdup(slapi_sdn_get_ndn(sdn)),
                                          NULL, NULL, NULL, bind_target_entry);
                     if (!slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA)) {
-                        /* check if need new password before sending 
-                           the bind success result */
-                        myrc = need_new_pw(pb, &t, bind_target_entry, pw_response_requested);
-                        switch (myrc) {
-                        case 1:
-                            (void)slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
-                            break;
-                        case 2:
-                            (void)slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRING, t);
-                            break;
-                        default:
-                            break;
-                        }
+                        /* check if need new password before sending the bind success result */
+                        myrc = need_new_pw(pb, bind_target_entry, pw_response_requested);
                     }
                 }
                 if (auth_response_requested) {
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 9696ead..0ba61d7 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -972,7 +972,7 @@ int plugin_call_acl_verify_syntax ( Slapi_PBlock *pb, Slapi_Entry *e, char **err
  * pw_mgmt.c
  */
 void pw_init( void );
-int need_new_pw( Slapi_PBlock *pb, long *t,  Slapi_Entry *e, int pwresponse_req );
+int need_new_pw(Slapi_PBlock *pb, Slapi_Entry *e, int pwresponse_req);
 int update_pw_info( Slapi_PBlock *pb , char *old_pw );
 int check_pw_syntax( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals, 
 	char **old_pw, Slapi_Entry *e, int mod_op );
@@ -982,7 +982,6 @@ void get_old_pw( Slapi_PBlock *pb, const Slapi_DN *sdn, char **old_pw);
 int check_account_lock( Slapi_PBlock *pb, Slapi_Entry * bind_target_entry, int pwresponse_req, int account_inactivation_only /*no wire/no pw policy*/);
 int check_pw_minage( Slapi_PBlock *pb, const Slapi_DN *sdn, struct berval **vals) ;
 void add_password_attrs( Slapi_PBlock *pb, Operation *op, Slapi_Entry *e );
-
 int add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e);
 
 /*
diff --git a/ldap/servers/slapd/pw_mgmt.c b/ldap/servers/slapd/pw_mgmt.c
index 7252c08..b06e3f1 100644
--- a/ldap/servers/slapd/pw_mgmt.c
+++ b/ldap/servers/slapd/pw_mgmt.c
@@ -22,234 +22,239 @@
 /* prototypes                                                               */
 /****************************************************************************/
 
-/* need_new_pw() is called when non rootdn bind operation succeeds with authentication */ 
+/*
+ * need_new_pw() is called when non rootdn bind operation succeeds with authentication
+ *
+ * Return  0 - password is okay
+ * Return -1 - password is expired, abort bind
+ */
 int
-need_new_pw( Slapi_PBlock *pb, long *t, Slapi_Entry *e, int pwresponse_req )
+need_new_pw(Slapi_PBlock *pb, Slapi_Entry *e, int pwresponse_req)
 {
-	time_t 		cur_time, pw_exp_date;
-	Slapi_Mods smods;
-	double		diff_t = 0;
-	char 		*cur_time_str = NULL;
-	char *passwordExpirationTime = NULL;
-	char *timestring;
-	char *dn;
-	const Slapi_DN *sdn;
-	passwdPolicy *pwpolicy = NULL;
-	int	pwdGraceUserTime = 0;
-	char graceUserTime[8];
-
-	if (NULL == e) {
-		return (-1);
-	}
-	slapi_mods_init (&smods, 0);
-	sdn = slapi_entry_get_sdn_const( e );
-	dn = slapi_entry_get_ndn( e );
-	pwpolicy = new_passwdPolicy(pb, dn);
-
-	/* after the user binds with authentication, clear the retry count */
-	if ( pwpolicy->pw_lockout == 1)
-	{
-		if(slapi_entry_attr_get_int( e, "passwordRetryCount") > 0)
-		{
-			slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordRetryCount", "0");
-		}
-	}
-
-	cur_time = current_time();
-
-	/* get passwordExpirationTime attribute */
-	passwordExpirationTime= slapi_entry_attr_get_charptr(e, "passwordExpirationTime");
-
-	if (passwordExpirationTime == NULL)
-	{
-		/* password expiration date is not set.
-		 * This is ok for data that has been loaded via ldif2ldbm
-		 * Set expiration time if needed,
-		 * don't do further checking and return 0 */
-		if (pwpolicy->pw_exp == 1) {
-			pw_exp_date = time_plus_sec(cur_time, pwpolicy->pw_maxage);
-
-			timestring = format_genTime (pw_exp_date);
-			slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
-			slapi_ch_free_string(&timestring);
-			slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpWarned", "0");
-			
-			pw_apply_mods(sdn, &smods);
-		} else if (pwpolicy->pw_lockout == 1) {
-			pw_apply_mods(sdn, &smods);
-		}
-		slapi_mods_done(&smods);
-		return ( 0 );
-	}
-
-	pw_exp_date = parse_genTime(passwordExpirationTime);
-
-	slapi_ch_free_string(&passwordExpirationTime);
-
-	/* Check if password has been reset */
-	if ( pw_exp_date == NO_TIME ) {
-
-		/* check if changing password is required */  
-		if ( pwpolicy->pw_must_change ) {
-			/* set c_needpw for this connection to be true.  this client 
-			   now can only change its own password */
-			pb->pb_conn->c_needpw = 1;
-			*t=0;
-			/* We need to include "changeafterreset" error in
-			 * passwordpolicy response control. So, we will not be
-			 * done here. We remember this scenario by (c_needpw=1)
-			 * and check it before sending the control from various
-			 * places. We will also add LDAP_CONTROL_PWEXPIRED control
-			 * as the return value used to be (1).
-			 */
-			goto skip;
-		}
-		/* Mark that first login occured */
-		pw_exp_date = NOT_FIRST_TIME;
-		timestring = format_genTime(pw_exp_date);
-		slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
-		slapi_ch_free_string(&timestring);
-	}
+    time_t cur_time, pw_exp_date;
+    Slapi_Mods smods;
+    double diff_t = 0;
+    char *cur_time_str = NULL;
+    char *passwordExpirationTime = NULL;
+    char *timestring;
+    char *dn;
+    const Slapi_DN *sdn;
+    passwdPolicy *pwpolicy = NULL;
+    int pwdGraceUserTime = 0;
+    char graceUserTime[16] = {0};
+    Connection *pb_conn = NULL;
+    long t;
+
+    if (NULL == e) {
+        return (-1);
+    }
+    slapi_mods_init(&smods, 0);
+    sdn = slapi_entry_get_sdn_const(e);
+    dn = slapi_entry_get_ndn(e);
+    pwpolicy = new_passwdPolicy(pb, dn);
+
+    /* after the user binds with authentication, clear the retry count */
+    if (pwpolicy->pw_lockout == 1) {
+        if (slapi_entry_attr_get_int(e, "passwordRetryCount") > 0) {
+            slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordRetryCount", "0");
+        }
+    }
+
+    cur_time = current_time();
+
+    /* get passwordExpirationTime attribute */
+    passwordExpirationTime = slapi_entry_attr_get_charptr(e, "passwordExpirationTime");
+
+    if (passwordExpirationTime == NULL) {
+        /* password expiration date is not set.
+         * This is ok for data that has been loaded via ldif2ldbm
+         * Set expiration time if needed,
+         * don't do further checking and return 0 */
+        if (pwpolicy->pw_exp == 1) {
+            pw_exp_date = time_plus_sec(cur_time, pwpolicy->pw_maxage);
+
+            timestring = format_genTime(pw_exp_date);
+            slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
+            slapi_ch_free_string(&timestring);
+            slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpWarned", "0");
+
+            pw_apply_mods(sdn, &smods);
+        } else if (pwpolicy->pw_lockout == 1) {
+            pw_apply_mods(sdn, &smods);
+        }
+        slapi_mods_done(&smods);
+        return (0);
+    }
+
+    pw_exp_date = parse_genTime(passwordExpirationTime);
+
+    slapi_ch_free_string(&passwordExpirationTime);
+
+    slapi_pblock_get(pb, SLAPI_CONNECTION, &pb_conn);
+
+    /* Check if password has been reset */
+    if (pw_exp_date == NO_TIME) {
+
+        /* check if changing password is required */
+        if (pwpolicy->pw_must_change) {
+            /* set c_needpw for this connection to be true.  this client
+               now can only change its own password */
+            pb_conn->c_needpw = 1;
+            t = 0;
+            /* We need to include "changeafterreset" error in
+             * passwordpolicy response control. So, we will not be
+             * done here. We remember this scenario by (c_needpw=1)
+             * and check it before sending the control from various
+             * places. We will also add LDAP_CONTROL_PWEXPIRED control
+             * as the return value used to be (1).
+             */
+            goto skip;
+        }
+        /* Mark that first login occured */
+        pw_exp_date = NOT_FIRST_TIME;
+        timestring = format_genTime(pw_exp_date);
+        slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
+        slapi_ch_free_string(&timestring);
+    }
 
 skip:
-	/* if password never expires, don't need to go on; return 0 */
-	if ( pwpolicy->pw_exp == 0 ) {
-		/* check for "changeafterreset" condition */
-		if (pb->pb_conn->c_needpw == 1) {
-			if (pwresponse_req) {
-				slapi_pwpolicy_make_response_control ( pb, -1, -1, LDAP_PWPOLICY_CHGAFTERRESET );
-			} 
-			slapi_add_pwd_control ( pb, LDAP_CONTROL_PWEXPIRED, 0);
-		}
-		pw_apply_mods(sdn, &smods);
-		slapi_mods_done(&smods);
-		return ( 0 );
-	}
-
-	/* check if password expired.  If so, abort bind. */
-	cur_time_str = format_genTime ( cur_time );
-	if ((pw_exp_date != NO_TIME) && (pw_exp_date != NOT_FIRST_TIME) &&
-	    (diff_t = difftime(pw_exp_date, parse_genTime(cur_time_str))) <= 0) {
-		slapi_ch_free_string(&cur_time_str); /* only need this above */
-		/* password has expired. Check the value of 
-		 * passwordGraceUserTime and compare it
-		 * against the value of passwordGraceLimit */
-		pwdGraceUserTime = slapi_entry_attr_get_int( e, "passwordGraceUserTime");
-		if ( pwpolicy->pw_gracelimit > pwdGraceUserTime ) {
-			pwdGraceUserTime++;
-			sprintf ( graceUserTime, "%d", pwdGraceUserTime );
-			slapi_mods_add_string(&smods, LDAP_MOD_REPLACE,
-				"passwordGraceUserTime", graceUserTime);
-			pw_apply_mods(sdn, &smods);
-			slapi_mods_done(&smods);
-			if (pwresponse_req) {
-				/* check for "changeafterreset" condition */
-				if (pb->pb_conn->c_needpw == 1) {
-					slapi_pwpolicy_make_response_control( pb, -1, 
-						((pwpolicy->pw_gracelimit) - pwdGraceUserTime),
-						LDAP_PWPOLICY_CHGAFTERRESET);
-				} else {
-					slapi_pwpolicy_make_response_control( pb, -1, 
-						((pwpolicy->pw_gracelimit) - pwdGraceUserTime),
-						-1);
-				}
-			}
-			
-			if (pb->pb_conn->c_needpw == 1) {
-				slapi_add_pwd_control ( pb, LDAP_CONTROL_PWEXPIRED, 0);
-			}
-			return ( 0 );
-		}
-
-		/* password expired and user exceeded limit of grace attemps.
-		 * Send result and also the control */
-		slapi_add_pwd_control ( pb, LDAP_CONTROL_PWEXPIRED, 0);
-		if (pwresponse_req) {
-			slapi_pwpolicy_make_response_control ( pb, -1, -1, LDAP_PWPOLICY_PWDEXPIRED );
-		}
-		slapi_send_ldap_result ( pb, LDAP_INVALID_CREDENTIALS, NULL,
-			"password expired!", 0, NULL );
-		
-		/* abort bind */
-		/* pass pb to do_unbind().  pb->pb_op->o_opid and 
-		   pb->pb_op->o_tag are not right but I don't see 
-		   do_unbind() checking for those.   We might need to 
-		   create a pb for unbind operation.  Also do_unbind calls
-		   pre and post ops.  Maybe we don't want to call them */
-		if (pb->pb_conn && (LDAP_VERSION2 == pb->pb_conn->c_ldapversion)) {
-			/* We close the connection only with LDAPv2 connections */
-			disconnect_server( pb->pb_conn, pb->pb_op->o_connid,
-				pb->pb_op->o_opid, SLAPD_DISCONNECT_UNBIND, 0);
-		}
-		/* Apply current modifications */
-		pw_apply_mods(sdn, &smods);
-		slapi_mods_done(&smods);
-		return (-1);
-	}
-	slapi_ch_free((void **) &cur_time_str );
-
-	/* check if password is going to expire within "passwordWarning" */
-	/* Note that if pw_exp_date is NO_TIME or NOT_FIRST_TIME,
-	 * we must send warning first and this changes the expiration time.
-	 * This is done just below since diff_t is 0 
-	 */
-	if ( diff_t <= pwpolicy->pw_warning ) {
-		int pw_exp_warned = 0;
-		
-		pw_exp_warned = slapi_entry_attr_get_int( e, "passwordExpWarned");
-		if ( !pw_exp_warned ){
-			/* first time send out a warning */
-			/* reset the expiration time to current + warning time 
-			 * and set passwordExpWarned to true
-			 */
-			if (pb->pb_conn->c_needpw != 1) {
-				pw_exp_date = time_plus_sec(cur_time, pwpolicy->pw_warning);
-			}
-			
-			timestring = format_genTime(pw_exp_date);
-			slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
-			slapi_ch_free_string(&timestring);
-
-			slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpWarned", "1");
-			
-			*t = pwpolicy->pw_warning;
-
-		} else {
-			*t = (long)diff_t; /* jcm: had to cast double to long */
-		}
-
-		pw_apply_mods(sdn, &smods);
-		slapi_mods_done(&smods);
-		if (pwresponse_req) {
-			/* check for "changeafterreset" condition */
-			if (pb->pb_conn->c_needpw == 1) {
-					slapi_pwpolicy_make_response_control( pb, *t, -1,
-						LDAP_PWPOLICY_CHGAFTERRESET);
-				} else {
-					slapi_pwpolicy_make_response_control( pb, *t, -1,
-						-1);
-				}
-		}
-
-		if (pb->pb_conn->c_needpw == 1) {
-			slapi_add_pwd_control ( pb, LDAP_CONTROL_PWEXPIRED, 0);
-		}
-		return (2);
-	} else {
-		if (pwresponse_req && pwpolicy->pw_send_expiring) {
-			slapi_pwpolicy_make_response_control( pb, diff_t, -1, -1);
-			slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRING, diff_t);
-		}
-	}
-
-	pw_apply_mods(sdn, &smods);
-	slapi_mods_done(&smods);
-	/* Leftover from "changeafterreset" condition */
-	if (pb->pb_conn->c_needpw == 1) {
-		slapi_add_pwd_control ( pb, LDAP_CONTROL_PWEXPIRED, 0);
-	}
-	/* passes checking, return 0 */
-	return( 0 );
+    /* if password never expires, don't need to go on; return 0 */
+    if (pwpolicy->pw_exp == 0) {
+        /* check for "changeafterreset" condition */
+        if (pb_conn->c_needpw == 1) {
+            if (pwresponse_req) {
+                slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_CHGAFTERRESET);
+            }
+            slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
+        }
+        pw_apply_mods(sdn, &smods);
+        slapi_mods_done(&smods);
+        return (0);
+    }
+
+    /* check if password expired.  If so, abort bind. */
+    cur_time_str = format_genTime(cur_time);
+    if ((pw_exp_date != NO_TIME) && (pw_exp_date != NOT_FIRST_TIME) &&
+        (diff_t = difftime(pw_exp_date, parse_genTime(cur_time_str))) <= 0) {
+        slapi_ch_free_string(&cur_time_str); /* only need this above */
+        /* password has expired. Check the value of
+         * passwordGraceUserTime and compare it
+         * against the value of passwordGraceLimit */
+        pwdGraceUserTime = slapi_entry_attr_get_int(e, "passwordGraceUserTime");
+        if (pwpolicy->pw_gracelimit > pwdGraceUserTime) {
+            pwdGraceUserTime++;
+            sprintf(graceUserTime, "%d", pwdGraceUserTime);
+            slapi_mods_add_string(&smods, LDAP_MOD_REPLACE,
+                                  "passwordGraceUserTime", graceUserTime);
+            pw_apply_mods(sdn, &smods);
+            slapi_mods_done(&smods);
+            if (pwresponse_req) {
+                /* check for "changeafterreset" condition */
+                if (pb_conn->c_needpw == 1) {
+                    slapi_pwpolicy_make_response_control(pb, -1,
+                                                         ((pwpolicy->pw_gracelimit) - pwdGraceUserTime),
+                                                         LDAP_PWPOLICY_CHGAFTERRESET);
+                } else {
+                    slapi_pwpolicy_make_response_control(pb, -1,
+                                                         ((pwpolicy->pw_gracelimit) - pwdGraceUserTime),
+                                                         -1);
+                }
+            }
+            slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
+            return (0);
+        }
+
+        /* password expired and user exceeded limit of grace attemps.
+         * Send result and also the control */
+        slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
+        if (pwresponse_req) {
+            slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_PWDEXPIRED);
+        }
+        slapi_send_ldap_result(pb, LDAP_INVALID_CREDENTIALS, NULL,
+                               "password expired!", 0, NULL);
+
+        /* abort bind */
+        /* pass pb to do_unbind().  pb->pb_op->o_opid and
+           pb->pb_op->o_tag are not right but I don't see
+           do_unbind() checking for those.   We might need to
+           create a pb for unbind operation.  Also do_unbind calls
+           pre and post ops.  Maybe we don't want to call them */
+        if (pb_conn && (LDAP_VERSION2 == pb_conn->c_ldapversion)) {
+            Operation *pb_op = NULL;
+            slapi_pblock_get(pb, SLAPI_OPERATION, &pb_op);
+            /* We close the connection only with LDAPv2 connections */
+            disconnect_server(pb_conn, pb_op->o_connid,
+                              pb_op->o_opid, SLAPD_DISCONNECT_UNBIND, 0);
+        }
+        /* Apply current modifications */
+        pw_apply_mods(sdn, &smods);
+        slapi_mods_done(&smods);
+        return (-1);
+    }
+    slapi_ch_free((void **)&cur_time_str);
+
+    /* check if password is going to expire within "passwordWarning" */
+    /* Note that if pw_exp_date is NO_TIME or NOT_FIRST_TIME,
+     * we must send warning first and this changes the expiration time.
+     * This is done just below since diff_t is 0
+     */
+    if (diff_t <= pwpolicy->pw_warning) {
+        int pw_exp_warned = 0;
+
+        pw_exp_warned = slapi_entry_attr_get_int(e, "passwordExpWarned");
+        if (!pw_exp_warned) {
+            /* first time send out a warning */
+            /* reset the expiration time to current + warning time
+             * and set passwordExpWarned to true
+             */
+            if (pb_conn->c_needpw != 1) {
+                pw_exp_date = time_plus_sec(cur_time, pwpolicy->pw_warning);
+            }
+
+            timestring = format_genTime(pw_exp_date);
+            slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
+            slapi_ch_free_string(&timestring);
+
+            slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpWarned", "1");
+
+            t = pwpolicy->pw_warning;
+
+        } else {
+            t = (long)diff_t; /* jcm: had to cast double to long */
+        }
+
+        pw_apply_mods(sdn, &smods);
+        slapi_mods_done(&smods);
+        if (pwresponse_req) {
+            /* check for "changeafterreset" condition */
+            if (pb_conn->c_needpw == 1) {
+                slapi_pwpolicy_make_response_control(pb, t, -1, LDAP_PWPOLICY_CHGAFTERRESET);
+            } else {
+                slapi_pwpolicy_make_response_control(pb, t, -1, -1);
+            }
+        }
+
+        if (pb_conn->c_needpw == 1) {
+            slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
+        } else {
+            slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRING, t);
+        }
+        return (0);
+    } else {
+        if (pwresponse_req && pwpolicy->pw_send_expiring) {
+            slapi_pwpolicy_make_response_control(pb, diff_t, -1, -1);
+            slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRING, diff_t);
+        }
+    }
+
+    pw_apply_mods(sdn, &smods);
+    slapi_mods_done(&smods);
+    /* Leftover from "changeafterreset" condition */
+    if (pb_conn->c_needpw == 1) {
+        slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
+    }
+    /* passes checking, return 0 */
+    return (0);
 }
 
 /* Called once from main */
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index dd0c4fb..134f5aa 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -859,7 +859,6 @@ ids_sasl_mech_supported(Slapi_PBlock *pb, const char *mech)
 void ids_sasl_check_bind(Slapi_PBlock *pb)
 {
     int rc, isroot;
-    long t;
     sasl_conn_t *sasl_conn;
     struct propctx *propctx;
     sasl_ssf_t *ssfp;
@@ -1096,23 +1095,8 @@ sasl_check_result:
         set_db_default_result_handlers(pb);
 
         /* check password expiry */
-        if (!isroot) {
-            int pwrc;
-
-            pwrc = need_new_pw(pb, &t, bind_target_entry, pwresponse_requested);
-            
-            switch (pwrc) {
-            case 1:
-                slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
-                break;
-            case 2:
-                slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRING, t);
-                break;
-            case -1:
-                goto out;
-            default:
-                break;
-            }
+        if (!isroot && need_new_pw(pb, bind_target_entry, pwresponse_requested) == -1) {
+            goto out;
         }
 
         /* attach the sasl data */
-- 
2.9.5