Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1361563 - Wrong pam error code returned for password change in offline mode
Summary: Wrong pam error code returned for password change in offline mode
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Petr Čech
QA Contact: Steeve Goveas
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-07-29 12:17 UTC by Jakub Hrozek
Modified: 2016-11-04 07:19 UTC (History)
6 users (show)

Fixed In Version: sssd-1.14.0-15.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-04 07:19:56 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2016:2476 normal SHIPPED_LIVE sssd bug fix and enhancement update 2016-11-03 14:08:11 UTC

Description Jakub Hrozek 2016-07-29 12:17:27 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/3109

sssd used to inform about password change in offline mode
{{{
sh$ passwd puser1
Changing password for user puser1.
System is offline, password change not possible
passwd: Authentication token manipulation error
}}}

The pam error code should be 9 and not 6

sssd.conf is minimal
{{{
    [sssd]
    services = nss, pam
    domains = LDAP

    [nss]

    [pam]

    [domain/LDAP]
    id_provider = ldap
    ldap_uri = ldaps://$SERVER
    ldap_search_base = $DS_BASE_DN
    ldap_tls_cacert = /etc/openldap/certs/cacert.asc
}}}

Redproducer:
* start sssd
* authenticate with test_user in online mode
* block access to LDAP 
* try to change password for user
  passwd test_user

Comment 2 Lukas Slebodnik 2016-08-08 12:44:40 UTC
master:
* 565e6dc434eec865c73ad1d0b61f86f5538dff01

Comment 4 Steeve Goveas 2016-09-21 11:00:49 UTC
Verified in version
sssd-1.14.0-38.el7.x86_64

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: offline_misc_001: Devel TRAC Ticket 642 doesn't gracefully fail password changes in ldap offline mode
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [  BEGIN   ] :: Running 'su_success puser1 Secret123'
:: [   PASS   ] :: Command 'su_success puser1 Secret123' (Expected 0, got 0)
spawn passwd puser1
Changing password for user puser1.
System is offline, password change not possible
passwd: Authentication token manipulation error
:: [   PASS   ] :: File '/tmp/change_offline_user_pass.out' should contain 'System is offline, password change not possible' 
:: [   PASS   ] :: File '/var/log/secure' should contain 'System is offline, password change not possible' 
'15fd4b22-c8af-4108-9fab-749bc9f84fdf'
offline-misc-001-Devel-TRAC-Ticket-642-doesn-t-gracefully-fail-password-changes-in-ldap-offline-mode result: PASS

Comment 6 errata-xmlrpc 2016-11-04 07:19:56 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2476.html


Note You need to log in before you can comment on or make changes to this bug.