Bug 2127833
| Summary: | Password Policy Grace login limit allows invalid maximum value | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Michal Polovka <mpolovka> | ||||
| Component: | ipa | Assignee: | Rob Crittenden <rcritten> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Ganna Kaihorodova <gkaihoro> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 9.1 | CC: | amore, frenaud, ftrivino, gkaihoro, pasik, rcritten, tscherf | ||||
| Target Milestone: | rc | Keywords: | Triaged | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | ipa-4.10.1-1.el9 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2023-05-09 07:32:52 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
It should be Int.MAXINT. This was originally an unsigned integer but during testing was changed to signed so that there could be a state for completely disabled (-1). Linked to upstream issue https://pagure.io/freeipa/issue/9243 Upstream PR https://github.com/freeipa/freeipa/pull/6456 Fixed upstream master: https://pagure.io/freeipa/c/36591995ac45fab0b25c98aa50814bf07a260d46 Fixed upstream: ipa-4-10: https://pagure.io/freeipa/c/3c4386ce057a0fd50c7494db43c71405c9674b8f Fixed upstream ipa-4-9: https://pagure.io/freeipa/c/91a02174a0a9694fd5611c071913ad4720be5ac9 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (ipa bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2205 |
Created attachment 1912878 [details] WebUI errors Description of problem: Grace login limit allows values from range -1 to 2**32-1 instead of declared MAXINT, which is defined as 2**31-1 and in discrepancy with other fields in Password Policy. This is applicable to both WebUI (see the screen-shot attached) and CLI. # ipa pwpolicy-mod --gracelimit=4294967296 ipa: ERROR: invalid 'gracelimit': can be at most 4294967295 Version-Release number of selected component (if applicable): ipa-server-4.10.0-6.el9.x86_64 How reproducible: Always Steps to Reproduce: 1.ipa pwpolicy-mod --gracelimit=4294967295 # 2**32 Actual results: # ipa pwpolicy-mod --gracelimit=4294967295 Group: global_policy Max lifetime (days): 90 Min lifetime (hours): 1 History size: 0 Character classes: 0 Min length: 8 Max failures: 6 Failure reset interval: 60 Lockout duration: 600 Grace login limit: 4294967295 Expected results: ipa: ERROR: invalid 'gracelimit': can be at most 2147483647 # 2**31 - 1 Additional info: In the documentation for the feature, it is defined: Range values for passwordgracelimit are: -1 : password grace checking is disabled 0 : no grace BIND are allowed at all post-expiration 1..MAXINT: the number of BIND allowed post-expiration