Bug 1118007

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/458

https://bugzilla.redhat.com/show_bug.cgi?id=856577 (''Red Hat Directory Server'')

{{{
3. What is the nature and description of the request?

For automated password reset procedures the hashed password has to be imported
via ldif file into LDAP server. If password syntax check is enabled only the
cn=directory manager is allowed to do it. but due to permission separation the
import user should only have access to a certain tree in LDAP.


4. Why does the customer need this? (List the business requirements here)

To support the following scenario:
a) A password reset is triggered from another server.
b) No interactive access is granted to the support personnel. They have to
create an ldif file which is loaded into LDAP.
c) LDAP is also used for the authentication of non-user sessions and all
changes have to be done via ldif files.
d) Due to security restrictions only hashed passwords are allowed in ldif
files.


5. How would the customer like to achieve this? (List the functional
requirements here)

Add a special role for the admin user of LDAP subtree which allows them to
bypass the hashed password check when loading an ldif file with hashed
passwords.


6. For each functional requirement listed in question 5, specify how Red Hat
and the customer can test to confirm the requirement is successfully
implemented.

a) setup LDAP subtree
b) create admin user
c) activate password sytax check on subtree
d) import ldif file with hashed passord by admin user -> should fail
e) add special role to admin user
d) import ldif file with hashed passord by admin user -> should work


7. Is there already an existing RFE upstream or in Red Hat bugzilla?

Bug 843576, "RFE - forcing passwordmustchange attribute by non-cn=directory
manager" / upstream <https://fedorahosted.org/389/ticket/417> is in a closely
related are; perhaps this RFE can be merged with it.


8. Does the customer have any specific timeline dependencies?

No.


9. Is the sales team involved in this request and do they have any additional
input?

The sales team is actively involved in this account, but not in this request
specifically.


10. List any affected packages or components.

389-ds-base


11. Would the customer be able to assist in testing this functionality if
implemented?

Yes.
}}}