From d1799a5023e7acd28560f255cbc009d245bf719d Mon Sep 17 00:00:00 2001 From: =?utf8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= Date: Tue, 23 Feb 2021 14:31:41 +0000 Subject: [PATCH] ITS#7596 Report correct number of grace authentications left --- servers/slapd/overlays/ppolicy.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c index 468b20583c..5e879547e8 100644 --- a/servers/slapd/overlays/ppolicy.c +++ b/servers/slapd/overlays/ppolicy.c @@ -703,7 +703,7 @@ create_passcontrol( Operation *op, int exptime, int grace, LDAPPasswordPolicyErr } ber_printf( ber, "tO", PPOLICY_WARNING, &bv ); ch_free( bv.bv_val ); - } else if ( grace > 0 ) { + } else if ( grace >= 0 ) { ber_init2( b2, NULL, LBER_USE_DER ); ber_printf( b2, "ti", PPOLICY_GRACE, grace ); rc = ber_flatten2( b2, &bv, 1 ); @@ -1658,8 +1658,10 @@ grace: Debug( LDAP_DEBUG_ANY, "ppolicy_bind: Entry %s has an expired password: %d grace logins\n", e->e_name.bv_val, ngut ); - - if (ngut < 1) { + + ngut--; + + if (ngut < 0) { ppb->pErr = PP_passwordExpired; rs->sr_err = LDAP_INVALID_CREDENTIALS; goto done; -- 2.47.3