oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kadmin: allow enforcing password quality on admin password change

Browse Source 
This patch adds the "enforce_on_admin_set" configuration knob in the
[password_quality] section. When this is enabled, administrative password
changes via the kadmin or kpasswd protocols will be subject to password quality
checks. (An administrative password change is one where the authenticating
principal is different to the principal whose password is being changed.)

Note that kadmin running in local mode (-l) is unaffected by this patch.
This commit is contained in:
Luke Howard
2018-12-24 15:28:32 +11:00
parent 6ce1aa84c5
commit c89d3f3b8c
6 changed files with 103 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
doc/setup.texi
View File

@@ -470,6 +470,15 @@ classes. Default value if not given is 3.
The four different characters classes are, uppercase, lowercase,
number, special characters.
@item enforce_on_admin_set
The enforce_on_admin_set check validates that administrative password changes
via kpasswdd or kadmind are also subject to the password policy. Note that
@command{kadmin} in local mode can still bypass these. An administrative
password change is one where the identity of the authenticating principal
differs from the subject of the password change. Default value if not given is
true.
@end itemize
If you want to write your own shared object to check password