Map create and reset_passwd quality failures to a generic message

In the Heimdal backend, map password quality errors on account
creation or password reset to a generic error.  The kadmin protocol
doesn't have a mechanism for passing back the rich error message from
the password quality check, so all failures use the same error string.
Remap it here, since the error message from Heimdal is of dubious
accuracy.  This will only apply to sites that have patched Heimdal to
do password quality checks on administrative operations.

diff --git a/NEWS b/NEWS
index 94b12a174fdf76d3ad26d5aa0019a3a8972c0dbc..e8af5bd6cf52bbb6274399174f90afb6e93769ee 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,14 @@ kadmin-remctl 3.6 (unreleased)
     change, further expiration periods are normally controlled by the KDC
     configuration or policy.
 
+    In the Heimdal backend, map password quality errors on account
+    creation or password reset to a generic error.  The kadmin protocol
+    doesn't have a mechanism for passing back the rich error message from
+    the password quality check, so all failures use the same error string.
+    Remap it here, since the error message from Heimdal is of dubious
+    accuracy.  This will only apply to sites that have patched Heimdal to
+    do password quality checks on administrative operations.
+
 kadmin-remctl 3.5 (2013-10-10)
 
     Increase the timeout for initial authentication during a kpasswd

diff --git a/kadmin-backend-heim b/kadmin-backend-heim
index 8d83a59a9f5aa59eeeded7544cd27a1a19af8383..b1f8e686f147a55dc98a9fc87464216c11ff07c7 100755 (executable)
--- a/kadmin-backend-heim
+++ b/kadmin-backend-heim
@@ -45,6 +45,12 @@ use Time::Seconds;
 # Disable sending of kadmin's output to our standard output.
 $Expect::Log_Stdout = 0;
 
+# Generic error message used when account creation or password reset fail due
+# to a password quality error.  kadmin can't return the rich error message
+# from the password quality check, so we have to collapse all error messages
+# down to a single string.
+our $GENERIC_ERROR = 'password may be vulnerable to attack';
+
 # Account used to test password strength.
 our $STRENGTH   = 'service/password-strength';
 
@@ -299,6 +305,9 @@ sub kadmin_create {
 
     if (!eval { $kadmin->createPrincipal ($princdata, $password, 0) }) {
         my $error = $@ || "unknown error\n";
+        if ($error =~ /Password is in the password dictionary/) {
+            $error = $GENERIC_ERROR . "\n";
+        }
         warn "error: cannot create $principal: $error";
         exit 1;
     }
@@ -516,6 +525,9 @@ sub kadmin_reset {
     eval { $kadmin->changePassword ($principal, $password) };
     if ($@) {
         my $error = $@ || "unknown error\n";
+        if ($error =~ /Password is in the password dictionary/) {
+            $error = $GENERIC_ERROR . "\n";
+        }
         warn "error: cannot change password for $principal: $error\n";
         exit 1;
     }