Do password strength checking for create and reset_passwd

For the Heimdal version of kadmin-backend, do password strength checking
and report a proper error in both create and reset_passwd.  Previously,
a failure of strength checking would cause a silent failure to create a
principal.

diff --git a/kadmin-backend-heim b/kadmin-backend-heim
index 050f44c096fe5ba6bd83f87f675c76168f6a7538..d4b87c7f9340c1ff50c7b0362e6ecb05ffacc305 100755 (executable)
--- a/kadmin-backend-heim
+++ b/kadmin-backend-heim
@@ -239,9 +239,6 @@ sub kadmin_create {
     check_password ($password);
     kadmin_config ($instance) or return;
     $principal = "$principal/$instance" if $instance;
-    if ($CONFIG{$instance}{checking}) {
-        return unless password_check ($principal, $instance, $password);
-    }
 
     my $kadmin = kadmin_handle ($instance);
     my $princdata = eval { $kadmin->makePrincipal ($principal) };
@@ -824,6 +821,13 @@ sub reset_password {
         warn "error: password changes not permitted for that user\n";
         exit 2;
     }
+    if ($CONFIG{$instance}{checking}) {
+        unless (password_check ($principal, $instance, $password)) {
+            warn "error: password rejected by strength checking\n";
+            print "retstr: password rejected by strength checking\n";
+            exit 1;
+        }
+    }
     if ($CONFIG{$instance}{k5_admin}) {
         kadmin_reset ($principal, $instance, $password);
     } elsif ($CONFIG{$instance}{ad_config}) {
@@ -861,6 +865,13 @@ sub create_principal {
         print "retstr: account $principal/$instance already exists\n";
         exit 1;
     }
+    if ($CONFIG{$instance}{checking}) {
+        unless (password_check ($principal, $instance, $password)) {
+            warn "error: password rejected by strength checking\n";
+            print "retstr: password rejected by strength checking\n";
+            exit 1;
+        }
+    }
     kaserver_create ($principal, $instance, $password, $status);
     unless (ad_ldap_exists ($principal, $instance)) {
         ad_ldap_create ($principal, $instance, $password, $status);