pam: Do not prevent root from changing auth token

[arrowd]

In my workflow I use pam_sss to change passwords of AD domain users. It works fine when user changes his password himself, but it doesn't work I do the same with, for example, pamtester program running as root.

The history of this getuid() == 0 check traces down to 15 years ago and it still doesn't give a clear rationale.

The proposed patch fixes the problem for me.

[sumit-bose]

Hi,

typically there is a different semantic if the password change is called as a user or as root.

If it is called as s user the semantic is that the password will be changed after the user has authenticated themself by giving the current password of the account for which the password should be changed (typically the account of the user itself) and then the new password.

If it is called as root the semantic is a password reset, i.e. no additional authentication is required, being root is sufficient, and the password of any user can be set to a new one.

SSSD's support for the latter is quite limited because for the common use cases, users coming from remote sources like LDAP and actual authentication happens remote as well, e.g. with Kerberos or LDAP, SSSD does not have the privileges on the remote side to change the password. That's why this use case is rejected already in the PAM module.

bye,
Sumit

[arrowd]

I don't quite get it why it has be dependent on a user UID.

The password change happens on the domain controller side, which doesn't really care what local user's credentials are. If changing a password requires an authentication, the controller would ask client to authenticate, be it root or not.

Anyways, if this change can't be accepted as it is, maybe we can make this behavior optional based on argv?

[arrowd]

Is this PR rejected?

[sumit-bose]

Hi,

I'm sorry for the delay.

Is this PR rejected?

It depends on the use-case. If it is only about running pamtester as root I think this change is not needed because it would be possible to switch to a user with su before testing the password change with pamtester.

If there are other use-case as well I would prefer a command-line option (argv) to skip the check.

bye,
Sumit

[arrowd]

If there are other use-case as well

Yes, my context actually is a privileged daemon that manages users in the system and provides a way to change password for both local and domain accounts. To change the password of a user coming from SSSD I resort to calling pam_sss.so, which is why I need this feature.

I would prefer a command-line option (argv) to skip the check.

Sure, a fine solution. I'll prepare an update to the PR. Thanks for the feedback!

[sumit-bose]

Hi,

thank you for the updates. I'm fine wit the changes, ACK.

Now, at least one additional developer should do review.

bye,
Sumit

[alexey-tikhonov]

Is it worth a release note? (https://github.com/SSSD/sssd/blob/master/.git-commit-template#L16)

[pbrezina]

Hi, the patch is good, please, see minor nitpicking inline. It might be also worth to add a release not as Alexey suggested.

Thank you.