|
 |
62a0d7 |
From 01598f563378f8cf85e7a7fb0c29e7bf32518c3f Mon Sep 17 00:00:00 2001
|
|
|
62a0d7 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
62a0d7 |
Date: Fri, 22 Apr 2016 18:32:26 +0200
|
|
|
62a0d7 |
Subject: [PATCH] LDAP: Try also the AD access control for IPA users
|
|
|
62a0d7 |
|
|
|
62a0d7 |
Resolves:
|
|
|
62a0d7 |
https://fedorahosted.org/sssd/ticket/2927
|
|
|
62a0d7 |
|
|
|
62a0d7 |
If a user from an AD trusted domain is logging in, we should also check
|
|
|
62a0d7 |
their AD lockout status. This helps cases where the user might have been
|
|
|
62a0d7 |
disabled but is logging in with an SSH public key.
|
|
|
62a0d7 |
---
|
|
|
62a0d7 |
src/providers/ldap/sdap_access.c | 15 +++++++++++++++
|
|
|
62a0d7 |
1 file changed, 15 insertions(+)
|
|
|
62a0d7 |
|
|
|
62a0d7 |
diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
|
|
|
62a0d7 |
index 3ef45b717787058ec61c4d6875cb41bb2e8195fc..14ec34508636c19b288a57cd305d874705bdb842 100644
|
|
|
62a0d7 |
--- a/src/providers/ldap/sdap_access.c
|
|
|
62a0d7 |
+++ b/src/providers/ldap/sdap_access.c
|
|
|
62a0d7 |
@@ -741,6 +741,21 @@ static errno_t sdap_account_expired(struct sdap_access_ctx *access_ctx,
|
|
|
62a0d7 |
DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
62a0d7 |
"sdap_account_expired_rhds failed.\n");
|
|
|
62a0d7 |
}
|
|
|
62a0d7 |
+
|
|
|
62a0d7 |
+ if (ret == EOK &&
|
|
|
62a0d7 |
+ strcasecmp(expire, LDAP_ACCOUNT_EXPIRE_IPA) == 0) {
|
|
|
62a0d7 |
+ DEBUG(SSSDBG_TRACE_FUNC,
|
|
|
62a0d7 |
+ "IPA access control succeeded, checking AD "
|
|
|
62a0d7 |
+ "access control\n");
|
|
|
62a0d7 |
+ ret = sdap_account_expired_ad(pd, user_entry);
|
|
|
62a0d7 |
+ if (ret == ERR_ACCOUNT_EXPIRED || ret == ERR_ACCESS_DENIED) {
|
|
|
62a0d7 |
+ DEBUG(SSSDBG_TRACE_FUNC,
|
|
|
62a0d7 |
+ "sdap_account_expired_ad: %s.\n", sss_strerror(ret));
|
|
|
62a0d7 |
+ } else if (ret != EOK) {
|
|
|
62a0d7 |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
62a0d7 |
+ "sdap_account_expired_ad failed.\n");
|
|
|
62a0d7 |
+ }
|
|
|
62a0d7 |
+ }
|
|
|
62a0d7 |
} else if (strcasecmp(expire, LDAP_ACCOUNT_EXPIRE_NDS) == 0) {
|
|
|
62a0d7 |
ret = sdap_account_expired_nds(pd, user_entry);
|
|
|
62a0d7 |
if (ret == ERR_ACCESS_DENIED) {
|
|
|
62a0d7 |
--
|
|
|
62a0d7 |
2.4.11
|
|
|
62a0d7 |
|