Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2126383

Summary:	update_pw_encoding - Could not read password attribute with chain on update
Product:	Red Hat Directory Server	Reporter:	Anton Bobrov <abobrov>
Component:	389-ds-base	Assignee:	LDAP Maintainers <idm-ds-dev-bugs>
Status:	CLOSED MIGRATED	QA Contact:	LDAP QA Team <idm-ds-qe-bugs>
Severity:	medium	Docs Contact:	Zuzana Zoubkova <zzoubkov>
Priority:	high
Version:	12.1	CC:	bsmejkal, emartyny, idm-ds-dev-bugs, mreynolds, pasik, spichugi, tbordaz, vashirov
Target Milestone:	DS12.2	Keywords:	Triaged
Target Release:	dirsrv-12.5
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	sync-to-jira
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-06-26 13:48:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Anton Bobrov 2022-09-13 09:59:10 UTC

Description of problem:

When chain on update feature is enabled and userpassword attribute value has to be updated on bind (eg due to new default password storage scheme) the update_pw_encoding() logs WARNing messages like these

[26/Aug/2022:15:00:51.987076753 +0000] - WARN - update_pw_encoding - Could not read password attribute on '<DN>'

Regardless of whether or not a local bind should chain update_pw_encoding(), the message is misleading so it should be addressed either by chaining such updates if needed or not attempting them in the first place for remote backends.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Anton Bobrov 2022-09-13 10:07:23 UTC

diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index a1f00005c..e76207c55 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -799,7 +799,8 @@ do_bind(Slapi_PBlock *pb)
                      * if it was successful, and if we used a PW (else we replace the pw
                      * with the token, which would be bad!)
                      */
-                    if (pb_conn->c_bind_auth_token == 0 && config_get_enable_upgrade_hash()) {
+                    if (pb_conn->c_bind_auth_token == 0 && config_get_enable_upgrade_hash() &&
+                        !slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA)) {
                         update_pw_encoding(pb, bind_target_entry, sdn, cred.bv_val);
                     }

This blind fix should silence it however the problem should probably be addressed in the chain on update feature instead.

Comment 4 Viktor Ashirov 2024-06-26 13:48:04 UTC

This BZ has been automatically migrated to Red Hat Issue Tracker https://issues.redhat.com/browse/DIRSRV-31. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated. Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.