Bug 25461 - Can't authenticate after 'passwd -e' has been called
Summary: Can't authenticate after 'passwd -e' has been called
Status: RESOLVED FIXED
Alias: None
Product: PolicyKit
Classification: Unclassified
Component: daemon (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: David Zeuthen (not reading bugmail)
QA Contact: David Zeuthen (not reading bugmail)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-12-05 06:42 UTC by Milan Bouchet-Valat
Modified: 2011-02-23 05:22 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments

Description Milan Bouchet-Valat 2009-12-05 06:42:41 UTC
This was reported in Xubuntu [1]. It appears that if an admin marks your password for expiration using 'sudo passwd -e USER', you can't authenticate via PolicyKit until you log out. Is that the intended behavior?

/var/auth.log says:
> polkit-agent-helper-1[1537]: pam_unix(polkit-1:account): expired password for
> user USER (root enforced)


1: https://bugs.launchpad.net/ubuntu/+source/gnome-system-tools/+bug/315002
Comment 1 David Zeuthen (not reading bugmail) 2009-12-05 07:42:59 UTC
Funny, I was just discussing this with Jon yesterday (in another context) and the conclusion was that polkit authentication via PAM should do the account phase as well (and the screensaver shouldn't). 

We didn't discuss password-changing though - Jon, any thoughts?
Comment 2 David Zeuthen (not reading bugmail) 2011-02-23 05:18:56 UTC
We seem to be doing the right thing now:

 $ pkexec /usr/bin/pk-example-frobnicate 
 ==== AUTHENTICATING FOR org.freedesktop.policykit.example.pkexec.run-frobnicate ===
 Authentication is required to run the PolicyKit example program Frobnicate
 Authenticating as: David Zeuthen (davidz)
 Password: 
 Error: Your account has expired; please contact your system administrator
 polkit-agent-helper-1: pam_acct_mgmt failed: User account has expired
 Error: User account has expired
 ==== AUTHENTICATION FAILED ===
 Error executing command as another user: Not authorized

 This incident has been reported.
Comment 3 David Zeuthen (not reading bugmail) 2011-02-23 05:22:32 UTC
(In reply to comment #0)
> This was reported in Xubuntu [1]. It appears that if an admin marks your
> password for expiration using 'sudo passwd -e USER', you can't authenticate via
> PolicyKit until you log out. Is that the intended behavior?

Just to clarify, yeah, I do think this is intended behavior... at least for now... it of course begs the question how the user should _fix_ the problem.. because... presumably he would need to authenticate as himself to gain an authorization to change the expiration date of his account.

I'll leave that problem to others to figure out... probably Jon and Matthias should have a thinko about this in the accountsservice/accountsdialog projects.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.