Correctly handle incorrect password errors from Heimdal

Properly handle incorrect password errors from Heimdal's kpasswd.
Previously, if change_passwd failed because the original password was
incorrect, kadmin-remctl would output a confusing Expect error.

diff --git a/NEWS b/NEWS
index f2e8c945dc4c7c17b06d1c06d6f50eed49766a78..4b9de408303c0f95f1ad35291662bcfb83531d0f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,11 @@
                     User-Visible kadmin-remctl Changes
 
+kadmin-remctl 3.2 (unreleased)
+
+    Properly handle incorrect password errors from Heimdal's kpasswd.
+    Previously, if change_passwd failed because the original password was
+    incorrect, kadmin-remctl would output a confusing Expect error.
+
 kadmin-remctl 3.1 (2010-07-21)
 
     In the Heimdal backend, don't set KADM5_POLICY_NORMAL_MASK or

diff --git a/kadmin-backend-heim b/kadmin-backend-heim
index e960bfa00aca6b5164851d931c3f8b89e558285a..9e2e94415695b143dbfa93141b897568687e0309 100755 (executable)
--- a/kadmin-backend-heim
+++ b/kadmin-backend-heim
@@ -516,12 +516,17 @@ sub kpasswd {
 
     my ($num, $error, $match, $before, $after)
         = $kpasswd->expect (2, 'kpasswd: krb5_get_init_creds:',
+                            'kpasswd: Password incorrect',
                             '-re', 'New password for \S+:');
-    if ($num == 1) {
-        $after =~ s/\r?\n.*//s;
-        $after =~ s/^\s+//;
-        if ($after eq 'Preauthentication failed') {
-            $after = 'Password incorrect while getting initial ticket';
+    if ($num == 1 || $num == 2) {
+        if ($num == 1) {
+            $after =~ s/\r?\n.*//s;
+            $after =~ s/^\s+//;
+            if ($after eq 'Preauthentication failed') {
+                $after = 'Password incorrect';
+            }
+        } else {
+            $after = 'Password incorrect';
         }
         warn "error: $after\n";
         print "retstr: $after\n";