IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

policy: add function to check lockout policy

Browse Source 
Fixes: https://fedorahosted.org/freeipa/ticket/2393
This commit is contained in:
Simo Sorce 2012-02-17 11:45:56 -05:00 committed by Rob Crittenden
parent ffd39503c1
commit 9942a29cab
3 changed files with 62 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
daemons/ipa-kdb/ipa_kdb.c
View File

@ -454,7 +454,7 @@ kdb_vftabl kdb_function_table = {
NULL, /* encrypt_key_data */ NULL, /* encrypt_key_data */
ipadb_sign_authdata, /* sign_authdata */ ipadb_sign_authdata, /* sign_authdata */
NULL, /* check_transited_realms */ NULL, /* check_transited_realms */
NULL, /* check_policy_as */ ipadb_check_policy_as, /* check_policy_as */
NULL, /* check_policy_tgs */ NULL, /* check_policy_tgs */
ipadb_audit_as_req, /* audit_as_req */ ipadb_audit_as_req, /* audit_as_req */
NULL, /* refresh_config */ NULL, /* refresh_config */

8
daemons/ipa-kdb/ipa_kdb.h
View File

@ -185,6 +185,14 @@ krb5_error_code ipadb_delete_pwd_policy(krb5_context kcontext,
char *policy); char *policy);
void ipadb_free_pwd_policy(krb5_context kcontext, osa_policy_ent_t val); void ipadb_free_pwd_policy(krb5_context kcontext, osa_policy_ent_t val);
krb5_error_code ipadb_check_policy_as(krb5_context kcontext,
krb5_kdc_req *request,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_timestamp kdc_time,
const char **status,
krb5_pa_data ***e_data);
/* MASTER KEY FUNCTIONS */ /* MASTER KEY FUNCTIONS */
krb5_error_code ipadb_fetch_master_key(krb5_context kcontext, krb5_error_code ipadb_fetch_master_key(krb5_context kcontext,
krb5_principal mname, krb5_principal mname,

53
daemons/ipa-kdb/ipa_kdb_pwdpolicy.c
View File

@ -275,3 +275,56 @@ void ipadb_free_pwd_policy(krb5_context kcontext, osa_policy_ent_t val)
} }
} }
krb5_error_code ipadb_check_policy_as(krb5_context kcontext,
krb5_kdc_req *request,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_timestamp kdc_time,
const char **status,
krb5_pa_data ***e_data)
{
struct ipadb_context *ipactx;
struct ipadb_e_data *ied;
krb5_error_code kerr;
if (!client) {
return ENOENT;
}
ipactx = ipadb_get_context(kcontext);
if (!ipactx) {
return EINVAL;
}
ied = (struct ipadb_e_data *)client->e_data;
if (!ied) {
return EINVAL;
}
if (!ied->pol) {
kerr = ipadb_get_ipapwd_policy(ipactx, ied->pw_policy_dn, &ied->pol);
if (kerr != 0) {
return kerr;
}
}
if (client->last_failed <= ied->last_admin_unlock) {
/* admin unlocked the account */
return 0;
}
if (ied->pol->max_fail == 0 ||
client->fail_auth_count < ied->pol->max_fail) {
/* still within allowed failures range */
return 0;
}
if (ied->pol->lockout_duration == 0 ||
client->last_failed + ied->pol->lockout_duration > kdc_time) {
/* ok client permanently locked, or within lockout period */
*status = "LOCKED_OUT";
return KRB5KDC_ERR_CLIENT_REVOKED;
}
return 0;
}