Bug 2126383

Summary:	update_pw_encoding - Could not read password attribute with chain on update
Product:	Red Hat Directory Server	Reporter:	Anton Bobrov <abobrov>
Component:	389-ds-base	Assignee:	LDAP Maintainers <idm-ds-dev-bugs>
Status:	NEW ---	QA Contact:	LDAP QA Team <idm-ds-qe-bugs>
Severity:	medium	Docs Contact:	Zuzana Zoubkova <zzoubkov>
Priority:	high
Version:	12.1	CC:	emartyny, idm-ds-dev-bugs, mreynolds, pasik, vashirov
Target Milestone:	DS12.2	Keywords:	Triaged
Target Release:	dirsrv-12.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	sync-to-jira
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Anton Bobrov 2022-09-13 09:59:10 UTC

Description of problem:

When chain on update feature is enabled and userpassword attribute value has to be updated on bind (eg due to new default password storage scheme) the update_pw_encoding() logs WARNing messages like these

[26/Aug/2022:15:00:51.987076753 +0000] - WARN - update_pw_encoding - Could not read password attribute on '<DN>'

Regardless of whether or not a local bind should chain update_pw_encoding(), the message is misleading so it should be addressed either by chaining such updates if needed or not attempting them in the first place for remote backends.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Anton Bobrov 2022-09-13 10:07:23 UTC

diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index a1f00005c..e76207c55 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -799,7 +799,8 @@ do_bind(Slapi_PBlock *pb)
                      * if it was successful, and if we used a PW (else we replace the pw
                      * with the token, which would be bad!)
                      */
-                    if (pb_conn->c_bind_auth_token == 0 && config_get_enable_upgrade_hash()) {
+                    if (pb_conn->c_bind_auth_token == 0 && config_get_enable_upgrade_hash() &&
+                        !slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA)) {
                         update_pw_encoding(pb, bind_target_entry, sdn, cred.bv_val);
                     }

This blind fix should silence it however the problem should probably be addressed in the chain on update feature instead.