[Freeipa-devel] [PATCH 0058] Fix login password expiration detection with OTP

[Nathaniel McCallum]

The preexisting code would execute two steps. First, it would perform a
kinit. If the kinit failed, it would attempt to bind using the same
credentials to determine if the password were expired. While this method
is fairly ugly, it mostly worked in the past.

However, with OTP this breaks. This is because the OTP code is consumed
by the kinit step. But because the password is expired, the kinit step
fails. When the bind is executed, the OTP token is already consumed, so
bind fails. This causes all password expirations to be reported as
invalid credentials.

After discussion with MIT, the best way to handle this case with the
standard tools is to set LC_ALL=C and check the output from the command.
This eliminates the bind step altogether. The end result is that OTP
works and all password failures are more performant.

https://fedorahosted.org/freeipa/ticket/4412
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-npmccallum-0058-Fix-login-password-expiration-detection-with-OTP.patch
Type: text/x-patch
Size: 5664 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20140714/79da017e/attachment.bin>