76 lines
3.0 KiB
Plaintext
76 lines
3.0 KiB
Plaintext
|
diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
|
||
|
|
index b473611..50c60b7 100644
|
||
|
|
--- a/src/plugins/kdb/db2/lockout.c
|
||
|
|
+++ b/src/plugins/kdb/db2/lockout.c
|
||
|
|
@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context,
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
+ if (entry == NULL)
|
||
|
|
+ return 0;
|
||
|
|
+
|
||
|
|
if (!db_ctx->disable_lockout) {
|
||
|
|
code = lookup_lockout_policy(context, entry, &max_fail,
|
||
|
|
&failcnt_interval, &lockout_duration);
|
||
|
|
@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context,
|
||
|
|
return code;
|
||
|
|
}
|
||
|
|
|
||
|
|
+ /*
|
||
|
|
+ * Don't continue to modify the DB for an already locked account.
|
||
|
|
+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
|
||
|
|
+ * this check is unneeded, but in rare cases, we can fail with an
|
||
|
|
+ * integrity error or preauth failure before a policy check.)
|
||
|
|
+ */
|
||
|
|
+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
|
||
|
|
+ return 0;
|
||
|
|
+
|
||
|
|
/* Only mark the authentication as successful if the entry
|
||
|
|
* required preauthentication, otherwise we have no idea. */
|
||
|
|
if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
|
||
|
|
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
|
||
|
|
index 552e39a..c2f44ab 100644
|
||
|
|
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
|
||
|
|
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
|
||
|
|
@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
|
||
|
|
CHECK_LDAP_HANDLE(ldap_context);
|
||
|
|
|
||
|
|
if (is_principal_in_realm(ldap_context, searchfor) != 0) {
|
||
|
|
+ st = KRB5_KDB_NOENTRY;
|
||
|
|
krb5_set_error_message (context, st, "Principal does not belong to realm");
|
||
|
|
goto cleanup;
|
||
|
|
}
|
||
|
|
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
|
||
|
|
index a218dc7..fd164dd 100644
|
||
|
|
--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
|
||
|
|
+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
|
||
|
|
@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context,
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
+ if (entry == NULL)
|
||
|
|
+ return 0;
|
||
|
|
+
|
||
|
|
if (!ldap_context->disable_lockout) {
|
||
|
|
code = lookup_lockout_policy(context, entry, &max_fail,
|
||
|
|
&failcnt_interval,
|
||
|
|
@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context,
|
||
|
|
return code;
|
||
|
|
}
|
||
|
|
|
||
|
|
- entry->mask = 0;
|
||
|
|
+ /*
|
||
|
|
+ * Don't continue to modify the DB for an already locked account.
|
||
|
|
+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
|
||
|
|
+ * this check is unneeded, but in rare cases, we can fail with an
|
||
|
|
+ * integrity error or preauth failure before a policy check.)
|
||
|
|
+ */
|
||
|
|
+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
|
||
|
|
+ return 0;
|
||
|
|
|
||
|
|
- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
|
||
|
|
+ entry->mask = 0;
|
||
|
|
|
||
|
|
/* Only mark the authentication as successful if the entry
|
||
|
|
* required preauthentication, otherwise we have no idea. */
|