Bug 1489693

Summary:	PasswordCheckSyntax attribute fails to validate cn, sn, uid and mail attributes [rhel-7.4.z]
Product:	Red Hat Enterprise Linux 7	Reporter:	Oneata Mircea Teodor <toneata>
Component:	389-ds-base	Assignee:	mreynolds
Status:	CLOSED ERRATA	QA Contact:	Viktor Ashirov <vashirov>
Severity:	urgent	Docs Contact:	Marc Muehlfeld <mmuehlfe>
Priority:	urgent
Version:	7.4	CC:	amsharma, mreynolds, msauton, nkinder, rmeggins, sramling
Target Milestone:	rc	Keywords:	ZStream
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	389-ds-base-1.3.6.1-20.el7_4	Doc Type:	Bug Fix
Doc Text:	Previously, subtree and user password policies did not use the same default values as the global password policy. As a consequence, Directory Server incorrectly skipped certain syntax checks. This bug has been fixed. As a result, the password policy features work the same for the global configuration and the subtree and user policies.	Story Points:	---
Clone Of:	1465600	Environment:
Last Closed:	2017-10-19 15:11:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1465600
Bug Blocks:

Description Oneata Mircea Teodor 2017-09-08 07:21:54 UTC

This bug has been copied from bug #1465600 and has been proposed to be backported to 7.4 z-stream (EUS).

Comment 4 Amita Sharma 2017-09-25 07:59:01 UTC

Executed - regression test under password policy test suit.

DS build: 1.3.6.1
389-ds-base: 1.3.6.1-20.el7_4
nss: 3.28.4-14.el7_4
nspr: 4.13.1-1.0.el7_3
openldap: 2.4.44-5.el7
svrcore: 4.1.3-2.el7

rootdir: /mnt/tests/rhds/tests/upstream/ds/dirsrvtests/tests/suites/password, inifile:
plugins: metadata-1.5.0, html-1.16.0
collected 34 items                                                                                                                                    

regression_test.py::test_trivial_passw_check[UIDpwtest1] OK group dirsrv exists
OK user dirsrv exists
INFO:lib389.topologies:Instance with parameters {'ldap-port': 38901, 'suffix': 'dc=example,dc=com', 'krb5_realm': None, 'deployed-dir': '/usr', 'inst-backupdir': '/tmp', 'hostname': 'localhost', 'server-id': 'standalone1', 'root-pw': 'password', 'root-dn': 'cn=Directory Manager', 'group-id': None, 'InstScriptsEnabled': None, 'user-id': None, 'ldap-secureport': None} was created.
INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to on
INFO:dirsrvtests.tests.suites.password.regression_test:Configure subtree password policy for ou=people,dc=example,dc=com
INFO:dirsrvtests.tests.suites.password.regression_test:Adding user-uid=UIDpwtest1,ou=people,dc=example,dc=com
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with UIDpwtest1
PASSED
regression_test.py::test_trivial_passw_check[MAILpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with MAILpwtest1
PASSED
regression_test.py::test_trivial_passw_check[GNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with GNpwtest1
PASSED
regression_test.py::test_trivial_passw_check[CNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1
PASSED
regression_test.py::test_trivial_passw_check[SNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with SNpwtest1
PASSED
regression_test.py::test_trivial_passw_check[CNpwtest1ZZZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1ZZZZ
PASSED
regression_test.py::test_trivial_passw_check[ZZZZZCNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZZZZCNpwtest1
PASSED
regression_test.py::test_trivial_passw_check[ZCNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZCNpwtest1
PASSED
regression_test.py::test_trivial_passw_check[CNpwtest1Z] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1Z
PASSED
regression_test.py::test_trivial_passw_check[ZCNpwtest1Z] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZCNpwtest1Z
PASSED
regression_test.py::test_trivial_passw_check[ZZCNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZCNpwtest1
PASSED
regression_test.py::test_trivial_passw_check[CNpwtest1ZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1ZZ
PASSED
regression_test.py::test_trivial_passw_check[ZZCNpwtest1ZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZCNpwtest1ZZ
PASSED
regression_test.py::test_trivial_passw_check[ZZZCNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZZCNpwtest1
PASSED
regression_test.py::test_trivial_passw_check[CNpwtest1ZZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1ZZZ
PASSED
regression_test.py::test_trivial_passw_check[ZZZCNpwtest1ZZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZZCNpwtest1ZZZ
PASSED
regression_test.py::test_trivial_passw_check[ZZZZZZCNpwtest1ZZZZZZZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZZZZZCNpwtest1ZZZZZZZZ
PASSED
regression_test.py::test_global_vs_local[UIDpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with UIDpwtest1
PASSED
regression_test.py::test_global_vs_local[MAILpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with MAILpwtest1
PASSED
regression_test.py::test_global_vs_local[GNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with GNpwtest1
PASSED
regression_test.py::test_global_vs_local[CNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1
PASSED
regression_test.py::test_global_vs_local[SNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with SNpwtest1
PASSED
regression_test.py::test_global_vs_local[CNpwtest1ZZZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1ZZZZ
PASSED
regression_test.py::test_global_vs_local[ZZZZZCNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZZZZCNpwtest1
PASSED
regression_test.py::test_global_vs_local[ZCNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZCNpwtest1
PASSED
regression_test.py::test_global_vs_local[CNpwtest1Z] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1Z
PASSED
regression_test.py::test_global_vs_local[ZCNpwtest1Z] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZCNpwtest1Z
PASSED
regression_test.py::test_global_vs_local[ZZCNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZCNpwtest1
PASSED
regression_test.py::test_global_vs_local[CNpwtest1ZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1ZZ
PASSED
regression_test.py::test_global_vs_local[ZZCNpwtest1ZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZCNpwtest1ZZ
PASSED
regression_test.py::test_global_vs_local[ZZZCNpwtest1] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZZCNpwtest1
PASSED
regression_test.py::test_global_vs_local[CNpwtest1ZZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with CNpwtest1ZZZ
PASSED
regression_test.py::test_global_vs_local[ZZZCNpwtest1ZZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZZCNpwtest1ZZZ
PASSED
regression_test.py::test_global_vs_local[ZZZZZZCNpwtest1ZZZZZZZZ] INFO:dirsrvtests.tests.suites.password.regression_test:Configure Pwpolicy with PasswordCheckSyntax and nsslapd-pwpolicy-local set to off
INFO:dirsrvtests.tests.suites.password.regression_test:Replace userPassword attribute with ZZZZZZCNpwtest1ZZZZZZZZ
PASSEDINFO:dirsrvtests.tests.suites.password.regression_test:Deleting user-uid=UIDpwtest1,ou=People,dc=example,dc=com
INFO:dirsrvtests.tests.suites.password.regression_test:Reset pwpolicy configuration settings
Instance slapd-standalone1 removed.


============================================================= 34 passed in 4.25 seconds ==============================================================

Hence passed.

Comment 6 errata-xmlrpc 2017-10-19 15:11:57 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2932