Exit with non-zero status if check_passwd fails

Exit with a non-zero status if the check_passwd command rejects the
password.  Previously, an error would be reported but the backend
would always report a successful zero status if the password could be
checked, even if it was rejected.

diff --git a/NEWS b/NEWS
index 725dbb5599f03a221789ea8c3b1267f1b25387d9..76418141a43818ba9b33175b582d918729420f65 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,11 @@ kadmin-remctl 3.3 (unreleased)
     functions uniformly use the same standard error formatting and exit
     status for kadmin failures.
 
+    Exit with a non-zero status if the check_passwd command rejects the
+    password.  Previously, an error would be reported but the backend
+    would always report a successful zero status if the password could be
+    checked, even if it was rejected.
+
     The Heimdal version of kadmin-backend now requires the IPC::Run Perl
     module (available from CPAN).
 

diff --git a/kadmin-backend b/kadmin-backend
index 1b6867140d27c48ce04cd465ea760d22aeb96166..4b53c6182b5c9e7099a99f4207468585cbeda1c0 100755 (executable)
--- a/kadmin-backend
+++ b/kadmin-backend
@@ -4,7 +4,7 @@
 #
 # Written by Russ Allbery <rra@stanford.edu>
 # Based heavily on work by Roland Schemers
-# Copyright 2003, 2007, 2008, 2009, 2010, 2011
+# Copyright 2003, 2007, 2008, 2009, 2010, 2011, 2013
 #     The Board of Trustees of the Leland Stanford Junior University
 #
 # Permission to use, copy, modify, and distribute this software and its
@@ -469,8 +469,8 @@ sub kadmin_expiration_check {
 # also set DISABLE_ALL_TIX) with the same password policy as our user accounts
 # and seeing if the password is accepted.
 #
-# On success, do nothing.  On failure, print the error message from K5 kadmin.
-# We don't die here because of weird interface requirements.
+# On success, do nothing.  On failure, print the error message from K5 kadmin
+# and exit with a non-zero status.
 sub kadmin_validate {
     my ($principal, $instance, $password) = @_;
     check_password ($password);
@@ -496,6 +496,7 @@ sub kadmin_validate {
         print "retstr: Insecure password: $match\n";
         $k5admin->send ("quit\n");
         $k5admin->soft_close;
+        exit 1;
     } elsif ($error) {
         die "error: Expect said $error\n";
     } else {

diff --git a/kadmin-backend-heim b/kadmin-backend-heim
index 35170ad1c0aa0f2746d411c41ae064bfe7635b8b..3e877d24870819fbb74195871db47ebed05d7052 100755 (executable)
--- a/kadmin-backend-heim
+++ b/kadmin-backend-heim
@@ -1318,7 +1318,9 @@ if ($cmd eq 'change_passwd') {
     my $princ = shift;
     my $pass  = shift or die "error: missing password\n";
 
-    password_check ($princ, '', $pass);
+    unless (password_check ($princ, '', $pass)) {
+        exit 1;
+    }
 
 } elsif ($cmd eq 'create') {