|
 |
61f723 |
From 578d207cd66e97e9ff8211559c62114a961e35a8 Mon Sep 17 00:00:00 2001
|
|
|
61f723 |
From: Mark Reynolds <mreynolds@redhat.com>
|
|
|
61f723 |
Date: Tue, 28 Mar 2017 14:21:47 -0400
|
|
|
61f723 |
Subject: [PATCH] Issue 49039 - password min age should be ignored if password
|
|
|
61f723 |
needs to be reset
|
|
|
61f723 |
|
|
|
61f723 |
Description: Do not check the password minimum age when changing a password
|
|
|
61f723 |
if the password "must" be reset.
|
|
|
61f723 |
|
|
|
61f723 |
https://pagure.io/389-ds-base/issue/49039
|
|
|
61f723 |
|
|
|
61f723 |
Reviewed by: firstyear(Thanks!)
|
|
|
61f723 |
---
|
|
|
61f723 |
dirsrvtests/tests/tickets/ticket49039_test.py | 79 +++++++++++++++++++++++++++
|
|
|
61f723 |
ldap/servers/slapd/modify.c | 4 +-
|
|
|
61f723 |
2 files changed, 81 insertions(+), 2 deletions(-)
|
|
|
61f723 |
create mode 100644 dirsrvtests/tests/tickets/ticket49039_test.py
|
|
|
61f723 |
|
|
|
61f723 |
diff --git a/dirsrvtests/tests/tickets/ticket49039_test.py b/dirsrvtests/tests/tickets/ticket49039_test.py
|
|
|
61f723 |
new file mode 100644
|
|
|
61f723 |
index 0000000..e6d4c03
|
|
|
61f723 |
--- /dev/null
|
|
|
61f723 |
+++ b/dirsrvtests/tests/tickets/ticket49039_test.py
|
|
|
61f723 |
@@ -0,0 +1,79 @@
|
|
|
61f723 |
+import time
|
|
|
61f723 |
+import ldap
|
|
|
61f723 |
+import logging
|
|
|
61f723 |
+import pytest
|
|
|
61f723 |
+from lib389 import Entry
|
|
|
61f723 |
+from lib389._constants import *
|
|
|
61f723 |
+from lib389.properties import *
|
|
|
61f723 |
+from lib389.tasks import *
|
|
|
61f723 |
+from lib389.utils import *
|
|
|
61f723 |
+from lib389.topologies import topology_st as topo
|
|
|
61f723 |
+
|
|
|
61f723 |
+DEBUGGING = os.getenv("DEBUGGING", default=False)
|
|
|
61f723 |
+if DEBUGGING:
|
|
|
61f723 |
+ logging.getLogger(__name__).setLevel(logging.DEBUG)
|
|
|
61f723 |
+else:
|
|
|
61f723 |
+ logging.getLogger(__name__).setLevel(logging.INFO)
|
|
|
61f723 |
+log = logging.getLogger(__name__)
|
|
|
61f723 |
+
|
|
|
61f723 |
+USER_DN = 'uid=user,dc=example,dc=com'
|
|
|
61f723 |
+
|
|
|
61f723 |
+
|
|
|
61f723 |
+def test_ticket49039(topo):
|
|
|
61f723 |
+ """Test "password must change" verses "password min age". Min age should not
|
|
|
61f723 |
+ block password update if the password was reset.
|
|
|
61f723 |
+ """
|
|
|
61f723 |
+
|
|
|
61f723 |
+ # Configure password policy
|
|
|
61f723 |
+ try:
|
|
|
61f723 |
+ topo.standalone.modify_s("cn=config", [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on'),
|
|
|
61f723 |
+ (ldap.MOD_REPLACE, 'passwordMustChange', 'on'),
|
|
|
61f723 |
+ (ldap.MOD_REPLACE, 'passwordExp', 'on'),
|
|
|
61f723 |
+ (ldap.MOD_REPLACE, 'passwordMaxAge', '86400000'),
|
|
|
61f723 |
+ (ldap.MOD_REPLACE, 'passwordMinAge', '8640000'),
|
|
|
61f723 |
+ (ldap.MOD_REPLACE, 'passwordChange', 'on')])
|
|
|
61f723 |
+ except ldap.LDAPError as e:
|
|
|
61f723 |
+ log.fatal('Failed to set password policy: ' + str(e))
|
|
|
61f723 |
+
|
|
|
61f723 |
+ # Add user, bind, and set password
|
|
|
61f723 |
+ try:
|
|
|
61f723 |
+ topo.standalone.add_s(Entry((USER_DN, {
|
|
|
61f723 |
+ 'objectclass': 'top extensibleObject'.split(),
|
|
|
61f723 |
+ 'uid': 'user1',
|
|
|
61f723 |
+ 'userpassword': PASSWORD
|
|
|
61f723 |
+ })))
|
|
|
61f723 |
+ except ldap.LDAPError as e:
|
|
|
61f723 |
+ log.fatal('Failed to add user: error ' + e.message['desc'])
|
|
|
61f723 |
+ assert False
|
|
|
61f723 |
+
|
|
|
61f723 |
+ # Reset password as RootDN
|
|
|
61f723 |
+ try:
|
|
|
61f723 |
+ topo.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'userpassword', PASSWORD)])
|
|
|
61f723 |
+ except ldap.LDAPError as e:
|
|
|
61f723 |
+ log.fatal('Failed to bind: error ' + e.message['desc'])
|
|
|
61f723 |
+ assert False
|
|
|
61f723 |
+
|
|
|
61f723 |
+ time.sleep(1)
|
|
|
61f723 |
+
|
|
|
61f723 |
+ # Reset password as user
|
|
|
61f723 |
+ try:
|
|
|
61f723 |
+ topo.standalone.simple_bind_s(USER_DN, PASSWORD)
|
|
|
61f723 |
+ except ldap.LDAPError as e:
|
|
|
61f723 |
+ log.fatal('Failed to bind: error ' + e.message['desc'])
|
|
|
61f723 |
+ assert False
|
|
|
61f723 |
+
|
|
|
61f723 |
+ try:
|
|
|
61f723 |
+ topo.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'userpassword', PASSWORD)])
|
|
|
61f723 |
+ except ldap.LDAPError as e:
|
|
|
61f723 |
+ log.fatal('Failed to change password: error ' + e.message['desc'])
|
|
|
61f723 |
+ assert False
|
|
|
61f723 |
+
|
|
|
61f723 |
+ log.info('Test Passed')
|
|
|
61f723 |
+
|
|
|
61f723 |
+
|
|
|
61f723 |
+if __name__ == '__main__':
|
|
|
61f723 |
+ # Run isolated
|
|
|
61f723 |
+ # -s for DEBUG mode
|
|
|
61f723 |
+ CURRENT_FILE = os.path.realpath(__file__)
|
|
|
61f723 |
+ pytest.main("-s %s" % CURRENT_FILE)
|
|
|
61f723 |
+
|
|
|
61f723 |
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
|
|
|
61f723 |
index 4bef90a..32defae 100644
|
|
|
61f723 |
--- a/ldap/servers/slapd/modify.c
|
|
|
61f723 |
+++ b/ldap/servers/slapd/modify.c
|
|
|
61f723 |
@@ -1326,8 +1326,8 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
|
|
|
61f723 |
|
|
|
61f723 |
/* check if password is within password minimum age;
|
|
|
61f723 |
error result is sent directly from check_pw_minage */
|
|
|
61f723 |
- if ((internal_op || !pb->pb_conn->c_needpw) &&
|
|
|
61f723 |
- check_pw_minage(pb, &sdn, mod->mod_bvalues) == 1)
|
|
|
61f723 |
+ if (!pb->pb_conn->c_needpw &&
|
|
|
61f723 |
+ check_pw_minage(pb, &sdn, mod->mod_bvalues) == 1)
|
|
|
61f723 |
{
|
|
|
61f723 |
if (operation_is_flag_set(operation,OP_FLAG_ACTION_LOG_ACCESS))
|
|
|
61f723 |
{
|
|
|
61f723 |
--
|
|
|
61f723 |
2.9.3
|
|
|
61f723 |
|