Attachment 10511 Details for Bug 52061

[patch] 0001-password_sync.quilt

0001-password_sync.quilt (text/plain), 4.73 KB, created by Arvid Requate on 2020-10-08 22:57 CEST

(hide)

Description:

Filename:

MIME Type:

Creator: Arvid Requate

Created: 2020-10-08 22:57 CEST

Size: 4.73 KB

patch

obsolete

>diff --git a/kpasswd/kpasswdd.c b/kpasswd/kpasswdd.c
>index 967bf93..23dd359 100644
>--- a/kpasswd/kpasswdd.c
>+++ b/kpasswd/kpasswdd.c
>@@ -41,6 +41,8 @@ RCSID("$Id$");
> #include <hdb.h>
> #include <kadm5/private.h>
> 
>+#include <python2.7/Python.h>
>+
> static krb5_context context;
> static krb5_log_facility *log_facility;
> 
>@@ -49,6 +51,9 @@ krb5_addresses explicit_addresses;
> 
> static sig_atomic_t exit_flag = 0;
> 
>+static PyObject *lib_password = NULL;
>+static PyObject *lib_password_change = NULL;
>+
> static void
> add_one_address (const char *str, int first)
> {
>@@ -253,6 +258,10 @@ change (krb5_auth_context auth_context,
>     krb5_data *pwd_data = NULL;
>     char *tmp;
>     ChangePasswdDataMS chpw;
>+    int ucs_error = -1;
>+
>+    PyObject *args = NULL, *call = NULL;
>+    PyObject *errobj = NULL, *errdata = NULL, *errtraceback = NULL, *pystring = NULL, *pystring2 = NULL;
> 
>     memset (&conf, 0, sizeof(conf));
>     memset(&chpw, 0, sizeof(chpw));
>@@ -407,6 +416,80 @@ change (krb5_auth_context auth_context,
>     tmp = pwd_data->data;
>     tmp[pwd_data->length - 1] = '\0';
> 
>+    // Sync password to UCS LDAP
>+
>+    // lib_password = PyImport_ImportModule("univention.lib.password");
>+    if (!lib_password)
>+    	goto ucs_done;
>+
>+    // lib_password_change = PyObject_GetAttrString(lib_password, "change");
>+    if (!lib_password_change)
>+    	goto ucs_done;
>+
>+    tmp = pwd_data->data;
>+    tmp[pwd_data->length - 1] = '\0';
>+
>+    args = Py_BuildValue("ss", client, tmp);
>+    if (!args)
>+    	goto ucs_done;
>+
>+    call = PyEval_CallObject(lib_password_change, args);
>+
>+    if (call == NULL) {
>+    	PyErr_Fetch(&errobj, &errdata, &errtraceback);
>+    	pystring = PyObject_Str(errobj);
>+    	if ( PyString_Check(pystring) ) {
>+    		const char *err = PyString_AsString(pystring);
>+    		ucs_error = 1;
>+
>+    		if( !strcmp(err, "<class 'univention.admin.uexceptions.pwalreadyused'>")) {
>+    			krb5_warnx (context, "%s", err);
>+    			reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SOFTERROR, "Password already used");
>+    		} else if( !strcmp(err, "<class 'univention.admin.uexceptions.pwToShort'>")) {
>+    			krb5_warnx (context,"%s",  err);
>+    			reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SOFTERROR, "Password is too short");
>+    		} else if( !strcmp(err, "<class 'univention.admin.uexceptions.pwQuality'>")) {
>+    			krb5_warnx (context, "%s", err);
>+    			pystring2 = PyObject_Str(errdata);
>+    			if ( PyString_Check(pystring2) ) {
>+    				const char *msg = PyString_AsString(pystring2);
>+    				reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SOFTERROR, msg);
>+    			} else {
>+    				reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SOFTERROR, "The passwort didn't pass quality check");
>+    			}
>+    		} else {
>+    			/*
>+    			 * Ignore all other errors, for example the user is not
>+    			 * a valid UCS user.
>+    			 */
>+    			ucs_error = -1;
>+    		}
>+    	}
>+    } else {
>+    	ucs_error = 0;
>+    }
>+
>+ucs_done:
>+    Py_XDECREF(errobj);
>+    Py_XDECREF(errdata);
>+    Py_XDECREF(errtraceback);
>+    Py_XDECREF(pystring);
>+    Py_XDECREF(pystring2);
>+    Py_XDECREF(args);
>+    Py_XDECREF(call);
>+
>+    if ( ucs_error == 0) {
>+    	/* change was successful */
>+    	reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SUCCESS, "Password changed");
>+        krb5_free_data (context, pwd_data);
>+        pwd_data = NULL;
>+    	goto out;
>+    } else if ( ucs_error == 1 ) {
>+    	/* failed to change the password pwToShort, pwalreadyused or pwQuality */
>+        krb5_free_data (context, pwd_data);
>+        pwd_data = NULL;
>+    	goto out;
>+    } /* else continue the kpasswdd pwd change */
>+
>     ret = kadm5_s_chpass_principal_cond (kadm5_handle, principal, 1, tmp);
>     krb5_free_data (context, pwd_data);
>     pwd_data = NULL;
>@@ -696,6 +773,11 @@ doit(krb5_keytab keytab, int port)
>     struct sockaddr_storage __ss;
>     struct sockaddr *sa = (struct sockaddr *)&__ss;
> 
>+    Py_Initialize();
>+    lib_password = PyImport_ImportModule("univention.lib.password");
>+    if (lib_password)
>+	lib_password_change = PyObject_GetAttrString(lib_password, "change");
>+
>     if (explicit_addresses.len) {
> 	addrs = explicit_addresses;
>     } else {
>@@ -777,6 +859,11 @@ doit(krb5_keytab keytab, int port)
> 
>     krb5_free_addresses(context, &addrs);
>     krb5_free_context(context);
>+
>+    Py_XDECREF(lib_password);
>+    Py_XDECREF(lib_password_change);
>+    Py_Finalize();
>+
>     return 0;
> }
> 
>diff --git a/kpasswd/Makefile.am b/kpasswd/Makefile.am
>index 7b85dfc..69ef613 100644
>--- a/kpasswd/Makefile.am
>+++ b/kpasswd/Makefile.am
>@@ -18,6 +18,7 @@ kpasswdd_LDADD = \
> 	$(top_builddir)/lib/kadm5/libkadm5srv.la \
> 	$(top_builddir)/lib/hdb/libhdb.la \
> 	$(LDADD) \
>+	-lpython2.7
> 	$(LIB_pidfile) \
> 	$(LIB_dlopen) \
> 	$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)

Actions: View | Diff

Attachments on bug 52061: 10511