Bug 1246389
| Summary: | wrong password check if passwordInHistory is decreased. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | German Parente <gparente> |
| Component: | 389-ds-base | Assignee: | Noriko Hosoi <nhosoi> |
| Status: | CLOSED ERRATA | QA Contact: | Viktor Ashirov <vashirov> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.1 | CC: | gparente, nhosoi, nkinder, rmeggins, spichugi |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | 389-ds-base-1.3.4.0-14.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 11:43:52 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Build tested: 389-ds-base-1.3.4.0-10.el7.x86_64 Pytest results: [spichugi@lib389-devel ds(master)]$ sudo ~/run_pytest.sh ~/ds/dirsrvtests/tickets/ticket48228_test.py Running /home/spichugi/ds/dirsrvtests/tickets/ticket48228_test.py tests ================================================= test session starts ================================================= platform linux2 -- Python 2.7.5 -- py-1.4.27 -- pytest-2.7.0 -- /usr/bin/python rootdir: /home/spichugi/ds/dirsrvtests/tickets, inifile: collected 3 items dirsrvtests/tickets/ticket48228_test.py::test_ticket48228_test_global_policy PASSED dirsrvtests/tickets/ticket48228_test.py::test_ticket48228_test_subtree_policy PASSED dirsrvtests/tickets/ticket48228_test.py::test_ticket48228_final PASSED ============================================== 3 passed in 26.35 seconds ============================================== Marking as verified. Build tested: 389-ds-base-1.3.4.0-13.el7.x86_64 [spichugi@lib389-devel ds(master)]$ sudo ~/run_pytest.sh ~/ds/dirsrvtests/tickets/ticket48228_test.py Running /home/spichugi/ds/dirsrvtests/tickets/ticket48228_test.py tests ================================================= test session starts ================================================= platform linux2 -- Python 2.7.5 -- py-1.4.27 -- pytest-2.7.0 -- /usr/bin/python rootdir: /home/spichugi/ds/dirsrvtests/tickets, inifile: collected 3 items dirsrvtests/tickets/ticket48228_test.py::test_ticket48228_test_global_policy PASSED dirsrvtests/tickets/ticket48228_test.py::test_ticket48228_test_subtree_policy PASSED dirsrvtests/tickets/ticket48228_test.py::test_ticket48228_final PASSED ============================================== 3 passed in 39.77 seconds ============================================== Marking as verified. The fix made in 389-ds-base-1.3.4.0-9.el7 caused a regression. Reopening... Sorry, Simon. When you verify this bug, could run TET/pwpolicy, as well? Unfortunately, test cases for the account usability are failing since OPENDS is not found on my test machine. https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/account-usability.html But at least this section in pwdpolicy.sh passes 100%. # Password History Section ic9="pwp_51 pwp_52 pwp_53 pwp_54 pwp_55 pwp_56 pwp_57" ic10="pwp_59 pwp_60 pwp_61 pwp_62 pwp_63 pwp_64" ic11="pwp_65 pwp_66 pwp_67 pwp_68" Thanks!! Build tested: 389-ds-base-1.3.4.0-14.el7.x86_64 Upstream test case ticket48228_test.py has the same output as in the Comment 12. All PASSED. Marking as verified. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2351.html |
Description of problem: Let's have passwordInHistory = N and a user with its N passwords in history. We decrease passwordInHistory to a value smaller than N. If a user changes its password to the oldest value in its history (of N values), it's forbidden but it should be allowed. Version-Release number of selected component (if applicable): How reproducible: always Steps to Reproduce: 1) configure password history feature with, for instance: passwordInHistory: 4 passwordHistory: on 2) add a new user [root@rh6 ~]# ldapmodify -p 2389 -h localhost -D "cn=directory manager" -w secret12 dn: uid=user50,ou=people,o=redhat changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount uid: user50 cn: user50 sn: user50 userpassword: user50 3) change password 4 times. 4) verify passwordHistory has the four values: ldapsearch -xLLL -p 2389 -h localhost -D "cn=directory manager" -w secret12 -b "uid=user50,ou=people,o=redhat" passwordHistory dn: uid=user50,ou=people,o=redhat passwordHistory: 20150724075220Zuser50 passwordHistory: 20150724075328Zuser50_1 passwordHistory: 20150724075341Zuser50_2 passwordHistory: 20150724075352Zuser50_3 5) decrease passwordInHistory to 3. ldapmodify -p 2389 -h localhost -D "cn=directory manager" -w secret12 dn: cn=config changetype: modify replace: passwordInHistory passwordInHistory: 3 6) change password using the original password: ldapmodify -p 2389 -h localhost -D "uid=user50,ou=people,o=redhat" -w user50_4 dn: uid=user50,ou=people,o=redhat changetype: modify replace: userPassword userPassword: user50 modifying entry "uid=user50,ou=people,o=redhat" ldap_modify: Constraint violation (19) additional info: password in history Actual results: password replaced by a password which should not be in history is not allowed. Expected results: It should be allowed. Additional info: in function update_pw_history if ( i >= pwpolicy->pw_inhistory ) { /* replace the oldest password in history */ instead of just replacing the oldest value, we could keep the N newest values (N == passwordInHistory) and replace the oldest in this group. As the same time the new passwordHistory of user entry will keep the right numbers of values. Workaround: trim the values as cn=directory manager