Description of problem:

this bug is a clone of 1246389 to request backport to 1.2.11.15 version.


Version-Release number of selected component (if applicable): 1.2.11.15-60


Let's have passwordInHistory = N and a user with its N passwords in history.
We decrease passwordInHistory to a value smaller than N.

If a user changes its password to the oldest value in its history (of N values), it's forbidden but it should be allowed. 

How reproducible: always

Steps to Reproduce:

 1) configure password history feature with, for instance:

passwordInHistory: 4
passwordHistory: on

2) add a new user

[root@rh6 ~]# ldapmodify -p 2389 -h localhost -D "cn=directory manager" -w secret12
dn: uid=user50,ou=people,o=redhat
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
uid: user50
cn: user50
sn: user50
userpassword: user50

3) change password 4 times.

4) verify passwordHistory has the four values:

    ldapsearch -xLLL -p 2389 -h localhost -D "cn=directory manager" -w secret12 -b "uid=user50,ou=people,o=redhat" passwordHistory

dn: uid=user50,ou=people,o=redhat
passwordHistory: 20150724075220Zuser50
passwordHistory: 20150724075328Zuser50_1
passwordHistory: 20150724075341Zuser50_2
passwordHistory: 20150724075352Zuser50_3

5) decrease passwordInHistory to 3.

ldapmodify -p 2389 -h localhost -D "cn=directory manager" -w secret12
dn: cn=config
changetype: modify
replace: passwordInHistory
passwordInHistory: 3

6) change password using the original password:

ldapmodify -p 2389 -h localhost -D "uid=user50,ou=people,o=redhat" -w user50_4
dn: uid=user50,ou=people,o=redhat
changetype: modify
replace: userPassword
userPassword: user50

modifying entry "uid=user50,ou=people,o=redhat"
ldap_modify: Constraint violation (19)

    additional info: password in history


Actual results:

password replaced by a password which should not be in history is not allowed.

Expected results:

It should be allowed.

Additional info:

in function update_pw_history

    if ( i >= pwpolicy->pw_inhistory ) {

        /* replace the oldest password in history */

instead of just replacing the oldest value, we could keep the N newest values (N == passwordInHistory) and replace the oldest in this group. As the same time the new passwordHistory of user entry will keep the right numbers of values.

Workaround: trim the values as cn=directory manager