Repository navigation
ldap: pwd_expire_policy_warn does not overwrite errors - #9393
sumit-bose wants to merge 4 commits into
Conversation
| :expectedresults: | ||
| 1. SSH is successful and shows 'Your password has expired.' on standard error | ||
| 2. Config change is successful | ||
| 3. SSH fails because the 'expire' policy rejects the locked user |
There was a problem hiding this comment.
LLM comment:
"""
The test sets only ldap_pwd_policy = shadow and never ldap_account_expire_policy (default NULL), so the expire rule denies through the "Missing account expire policy. Access denied" branch (sdap_access.c:725-728) — not shadow expiry. Concrete failure mode: the denial is incidental; if a default for ldap_account_expire_policy were ever introduced, the test could stop denying and silently stop guarding the CVE. The docstring ("the expire policy rejects the locked user") is also misleading. Make the denial intentional (real shadowExpire, or a non-matching filter per finding 1). The IPA test is clean by contrast (genuine nsAccountLock).
"""
There was a problem hiding this comment.
Hi,
makes sense, I created SSSD/sssd-test-framework#284 to allow to set shadowExpired as well to create a properly expired shadow user object.
bye,
Sumit
|
Fixes per see look good to me. |
There was a problem hiding this comment.
These tests are great, one nitpick and... these tests should be moved to test_ldap.py, since this file contains parametrized ad_access_filter and ldap_access_filter tests. Would expect any test in here to have that configurable.
I know the name is confusing, because ad_access_filter and ldap_access_filter, is access control with ldap filtering, explains the thought process.
| f"-l {user.name} localhost whoami", | ||
| raise_on_error=False, | ||
| ) | ||
| assert result.rc == 0, "SSH with pubkey failed" |
There was a problem hiding this comment.
nitpick, ! at the end of these assert messages, all assert messages.
There was a problem hiding this comment.
Exclamations marks added.
Make sure the 'pwd_expire_policy_warn' access check does not overwrite any access denied or other errors. :fixes: CVE-2026-92821
Verify fix for CVE-2026-92821 and make sure the 'pwd_expire_policy_warn' access check does not overwrite any access denied or other errors.
If the shadow scheme is used to determine if a password is expired or not the user currently does not see a message that the password is expired if the shadow attribute sp_lstchg is missing or 0. With this patch the message is shown in this case as well.
Verify fix for CVE-2026-92821 and make sure the 'pwd_expire_policy_warn' access check does not overwrite any access denied or other errors.
18f892e to
3ea8e24
Compare
Hi, I move the test to bye, |
3 participants
Make sure the 'pwd_expire_policy_warn' access check does not overwrite
any access denied or other errors.
:fixes: CVE-2026-92821