oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kadm5: move password quality checks out of daemons and into libkadm5

Browse Source 
Note that this has a slight behavior change to c89d3f3b in order to continue
allow kadmin in local mode to bypass password quality checks. Password quality
checks are always bypassed if the *client* kadmin principal is kadmin/admin,
i.e. that of the kadmin service itself. This is the case when running kadmin in
local mode. As this is the equivalent of a superuser account, one would
anticipate that deployments would use specific administrator instances for
appropriate ACLs for day-to-day administration; operations by these will be
subject to password quality checks if enforce_on_admin_set is TRUE, or if the
user is changing their own password.
This commit is contained in:
Luke Howard
2018-12-26 16:44:25 +11:00
committed by Nico Williams
parent 62c1790bf5
commit c6bf100b43
6 changed files with 80 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
lib/kadm5/create_s.c
View File

@@ -212,6 +212,21 @@ kadm5_s_create_principal(void *server_handle,
hdb_entry_ex ent;
kadm5_server_context *context = server_handle;
if (_kadm5_enforce_pwqual_on_admin_set_p(context)) {
krb5_data pwd_data;
const char *pwd_reason;
pwd_data.data = rk_UNCONST(password);
pwd_data.length = strlen(password);
pwd_reason = kadm5_check_password_quality(context->context,
princ->principal, &pwd_data);
if (pwd_reason != NULL) {
krb5_set_error_message(context->context, KADM5_PASS_Q_DICT, "%s", pwd_reason);
return KADM5_PASS_Q_DICT;
}
}
if ((mask & KADM5_KVNO) == 0) {
/* create_principal() through _kadm5_setup_entry(), will need this */
princ->kvno = 1;