andykimpe / rpms / 389-ds-base

Forked from rpms/389-ds-base 5 months ago
Clone

Blame SOURCES/0038-Issue-5221-User-with-expired-password-can-still-logi.patch

7a6e0a
From 1a5c28b6546214054ca44e57dc0c21b9a8a73baa Mon Sep 17 00:00:00 2001
7a6e0a
From: Mark Reynolds <mreynolds@redhat.com>
7a6e0a
Date: Thu, 3 Mar 2022 16:29:41 -0500
7a6e0a
Subject: [PATCH 4/4] Issue 5221 - User with expired password can still login
7a6e0a
 with full privledges
7a6e0a
7a6e0a
Bug Description:
7a6e0a
7a6e0a
A user with an expired password can still login and perform operations
7a6e0a
with its typical access perimssions.  But an expired password means the
7a6e0a
account should be considered anonymous.
7a6e0a
7a6e0a
Fix Description:
7a6e0a
7a6e0a
Clear the bind credentials if the password is expired
7a6e0a
7a6e0a
relates: https://github.com/389ds/389-ds-base/issues/5221
7a6e0a
7a6e0a
Reviewed by: progier(Thanks!)
7a6e0a
---
7a6e0a
 .../suites/password/pw_expired_access_test.py | 62 +++++++++++++++++++
7a6e0a
 ldap/servers/slapd/pw_mgmt.c                  |  1 +
7a6e0a
 2 files changed, 63 insertions(+)
7a6e0a
 create mode 100644 dirsrvtests/tests/suites/password/pw_expired_access_test.py
7a6e0a
7a6e0a
diff --git a/dirsrvtests/tests/suites/password/pw_expired_access_test.py b/dirsrvtests/tests/suites/password/pw_expired_access_test.py
7a6e0a
new file mode 100644
7a6e0a
index 000000000..fb0afb190
7a6e0a
--- /dev/null
7a6e0a
+++ b/dirsrvtests/tests/suites/password/pw_expired_access_test.py
7a6e0a
@@ -0,0 +1,62 @@
7a6e0a
+import ldap
7a6e0a
+import logging
7a6e0a
+import pytest
7a6e0a
+import os
7a6e0a
+import time
7a6e0a
+from lib389._constants import DEFAULT_SUFFIX, PASSWORD
7a6e0a
+from lib389.idm.domain import Domain
7a6e0a
+from lib389.idm.user import UserAccounts
7a6e0a
+from lib389.topologies import topology_st as topo
7a6e0a
+
7a6e0a
+log = logging.getLogger(__name__)
7a6e0a
+
7a6e0a
+def test_expired_user_has_no_privledge(topo):
7a6e0a
+    """Specify a test case purpose or name here
7a6e0a
+
7a6e0a
+    :id: 3df86b45-9929-414b-9bf6-06c25301d207
7a6e0a
+    :setup: Standalone Instance
7a6e0a
+    :steps:
7a6e0a
+        1. Set short password expiration time
7a6e0a
+        2. Add user and wait for expiration time to run out
7a6e0a
+        3. Set one aci that allows authenticated users full access
7a6e0a
+        4. Bind as user (password should be expired)
7a6e0a
+        5. Attempt modify
7a6e0a
+    :expectedresults:
7a6e0a
+        1. Success
7a6e0a
+        2. Success
7a6e0a
+        3. Success
7a6e0a
+        4. Success
7a6e0a
+        5. Success
7a6e0a
+    """
7a6e0a
+
7a6e0a
+    # Configured password epxiration
7a6e0a
+    topo.standalone.config.replace_many(('passwordexp', 'on'), ('passwordmaxage', '1'))
7a6e0a
+
7a6e0a
+    # Set aci
7a6e0a
+    suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
7a6e0a
+    ACI_TEXT = '(targetattr="*")(version 3.0; acl "test aci"; allow (all) (userdn="ldap:///all");)'
7a6e0a
+    suffix.replace('aci', ACI_TEXT)
7a6e0a
+
7a6e0a
+    # Add user
7a6e0a
+    user = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn=None).create_test_user()
7a6e0a
+    user.replace('userpassword', PASSWORD)
7a6e0a
+    time.sleep(2)
7a6e0a
+
7a6e0a
+    # Bind as user with expired password.  Need to use raw ldap calls because
7a6e0a
+    # lib389 will close the connection when an error 49 is encountered.
7a6e0a
+    ldap_object = ldap.initialize(topo.standalone.toLDAPURL())
7a6e0a
+    with pytest.raises(ldap.INVALID_CREDENTIALS):
7a6e0a
+        res_type, res_data, res_msgid, res_ctrls = ldap_object.simple_bind_s(
7a6e0a
+            user.dn, PASSWORD)
7a6e0a
+
7a6e0a
+    # Try modify
7a6e0a
+    with pytest.raises(ldap.INSUFFICIENT_ACCESS):
7a6e0a
+        modlist = [ (ldap.MOD_REPLACE, 'description', b'Should not work!') ]
7a6e0a
+        ldap_object.modify_ext_s(DEFAULT_SUFFIX, modlist)
7a6e0a
+
7a6e0a
+
7a6e0a
+if __name__ == '__main__':
7a6e0a
+    # Run isolated
7a6e0a
+    # -s for DEBUG mode
7a6e0a
+    CURRENT_FILE = os.path.realpath(__file__)
7a6e0a
+    pytest.main(["-s", CURRENT_FILE])
7a6e0a
diff --git a/ldap/servers/slapd/pw_mgmt.c b/ldap/servers/slapd/pw_mgmt.c
7a6e0a
index ca76fc12f..f9b5a9add 100644
7a6e0a
--- a/ldap/servers/slapd/pw_mgmt.c
7a6e0a
+++ b/ldap/servers/slapd/pw_mgmt.c
7a6e0a
@@ -211,6 +211,7 @@ skip:
7a6e0a
             slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_PWDEXPIRED);
7a6e0a
         }
7a6e0a
         slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
7a6e0a
+        bind_credentials_clear(pb_conn, PR_FALSE, PR_TRUE);
7a6e0a
         slapi_send_ldap_result(pb, LDAP_INVALID_CREDENTIALS, NULL,
7a6e0a
                                "password expired!", 0, NULL);
7a6e0a
 
7a6e0a
-- 
7a6e0a
2.31.1
7a6e0a