Repository navigation
ldap: pwd_expire_policy_warn does not overwrite errors - #9393
Conversation
|
Fixes per see look good to me. |
There was a problem hiding this comment.
These tests are great, one nitpick and... these tests should be moved to test_ldap.py, since this file contains parametrized ad_access_filter and ldap_access_filter tests. Would expect any test in here to have that configurable.
I know the name is confusing, because ad_access_filter and ldap_access_filter, is access control with ldap filtering, explains the thought process.
| f"-l {user.name} localhost whoami", | ||
| raise_on_error=False, | ||
| ) | ||
| assert result.rc == 0, "SSH with pubkey failed" |
There was a problem hiding this comment.
nitpick, ! at the end of these assert messages, all assert messages.
There was a problem hiding this comment.
Exclamations marks added.
18f892e to
3ea8e24
Compare
Hi, I move the test to bye, |
|
Failing |
Make sure the 'pwd_expire_policy_warn' access check does not overwrite any access denied or other errors. :fixes: CVE-2026-92821 Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Dan Lavu <dlavu@redhat.com>
Verify fix for CVE-2026-92821 and make sure the 'pwd_expire_policy_warn' access check does not overwrite any access denied or other errors. Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Dan Lavu <dlavu@redhat.com>
If the shadow scheme is used to determine if a password is expired or not the user currently does not see a message that the password is expired if the shadow attribute sp_lstchg is missing or 0. With this patch the message is shown in this case as well. Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Dan Lavu <dlavu@redhat.com>
Verify fix for CVE-2026-92821 and make sure the 'pwd_expire_policy_warn' access check does not overwrite any access denied or other errors. Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Dan Lavu <dlavu@redhat.com>
3ea8e24 to
c8b6a83
Compare
alexey-tikhonov
added
backport-to-sssd-2-13
and removed
backport-to-sssd-2-9
backport-to-sssd-2-13
labels
4 participants
Make sure the 'pwd_expire_policy_warn' access check does not overwrite
any access denied or other errors.
:fixes: CVE-2026-92821