Bug 1833515

Summary: set 'nsslapd-enable-upgrade-hash: off' as this raises warnings in IPA
Product: Red Hat Enterprise Linux 8 Reporter: mreynolds
Component: 389-ds-baseAssignee: mreynolds
Status: CLOSED ERRATA QA Contact: RHDS QE <ds-qe-bugs>
Severity: high Docs Contact:
Priority: unspecified    
Version: 8.2CC: ableisch, cheimes, ipa-qe, mreynolds, pasik, rcritten, spichugi, tbordaz, tscherf, twoerner, vashirov
Target Milestone: rcFlags: pm-rhel: mirror+
Target Release: 8.2   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: 389-ds-base-1.4.3.8-2.module+el8.3.0+6591+ebfc9766 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1833266 Environment:
Last Closed: 2020-11-04 03:07:52 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1833266    
Bug Blocks:    

Description mreynolds 2020-05-08 19:21:56 UTC 
+++ This bug was initially created as a clone of Bug #1833266 +++

Description of problem:
An upgraded version of 389-ds 1.4.1.6 will raise errors in the logs due to the inability to update passwords to new password-schemes.

Version-Release number of selected component (if applicable):
389-ds 1.4.1.6

How reproducible:
Always

Steps to Reproduce:
1. Install IDM prior 389-ds 1.4.1.6
2. Create users and passwords
3. Upgrade to 389-ds 1.4.1.6 or later

Actual results:
Warning messages written to /var/log/dirsrv/slapd-<instance>/errors:

WARN - update_pw_encoding - Modify error 19 on entry '<user-dn>'

Expected results:
No warning messages reported

Additional info:
Due to the integration of kerberos into IDM, passwords need to be given in cleartext in order to be updated. As there are only hashes stored in IDM, the update_pw_encoding() mechanism will not be able to update these and raises the warning messages.

--- Additional comment from Andreas Bleischwitz on 2020-05-08 09:21:55 UTC ---

The change to do password-schema updates was introduced with this: https://pagure.io/389-ds-base/issue/49421

--- Additional comment from Christian Heimes on 2020-05-08 09:36:24 UTC ---

Upstream ticket:
https://pagure.io/freeipa/issue/8315

--- Additional comment from  on 2020-05-08 19:19:09 UTC ---

DS upstream ticket to update schema to include "nsslapd-enable-upgrade-hash":

https://pagure.io/389-ds-base/issue/51078
Comment 4 Viktor Ashirov 2020-08-07 12:24:41 UTC 
Build tested: 389-ds-base-1.4.3.8-5.module+el8.3.0+7569+08175a8a.x86_64

The attribute is present in schema: 
ldapsearch -xLLL -D "cn=Directory Manager" -w password -b cn=schema '(objectClass=*)' * \+  | grep nsslapd-enable-upgrade-hash
attributeTypes: ( 2.16.840.1.113730.3.1.2370 NAME 'nsslapd-enable-upgrade-hash

It also passes IPA tests: https://bugzilla.redhat.com/show_bug.cgi?id=1833266#c9

Marking as VERIFIED.
Comment 7 errata-xmlrpc 2020-11-04 03:07:52 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (389-ds:1.4 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:4695