1390342 – ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1390342 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin

Summary: ns-accountstatus.pl shows wrong status for accounts inactivated by Account po...

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	389-ds-base
Sub Component:
Version:	7.3
Hardware:	x86_64
OS:	Linux
Priority:	urgent
Severity:	urgent
Target Milestone:	rc
Target Release:	---
Assignee:	Noriko Hosoi
QA Contact:	Viktor Ashirov
Docs Contact:
URL:
Whiteboard:
Depends On:	1379824
Blocks:
TreeView+	depends on / blocked

Reported:	2016-10-31 18:21 UTC by Tom Lavigne
Modified:	2016-12-06 17:04 UTC (History)
CC List:	11 users (show)
Fixed In Version:	389-ds-base-1.3.5.10-12.el7_3
Doc Type:	Bug Fix
Doc Text:	Previously, when "acctPolicySubentry" was not set in the "specattrname" parameter of the account policy plug-in, incorrect base distinguished name (DN) was used. As a consequence, the "ns-accountstatus.pl" script incorrectly showed the wrong status for accounts inactivated by inactivity. To fix the problem, the script now uses the existing config entry to obtain the inactivity limit if no "acctPolicySubentry" is set. As a result, the script now shows the correct status.
Clone Of:	1379824
Environment:
Last Closed:	2016-12-06 17:04:18 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2016:2879	0	normal	SHIPPED_LIVE	389-ds-base bug fix update	2016-12-06 22:00:22 UTC

Description Tom Lavigne 2016-10-31 18:21:21 UTC

This bug has been copied from bug #1379824 and has been proposed
to be backported to 7.3 z-stream (EUS).

Comment 6 Viktor Ashirov 2016-11-14 14:29:56 UTC

Old version:
389-ds-base-1.3.5.10-11.el7.x86_64

[0 root@qeos-210 ~]# ldapsearch -D cn=tuser,ou=People,dc=example,dc=com -w Secret123 -b dc=example,dc=com
ldap_bind: Constraint violation (19)
	additional info: Account inactivity limit exceeded. Contact system administrator to reset.
[0 root@qeos-210 ~]# ns-accountstatus.pl -D cn=Directory\ Manager -w Secret123 -I cn=tuser,ou=People,dc=example,dc=com -V; echo $? 
Entry:                   cn=tuser,ou=People,dc=example,dc=com
Entry Creation Date:     20161114134622Z (11/14/2016 08:46:22)
Entry Modification Date: 20161114141206Z (11/14/2016 09:12:06)
Last Login Date:         20161114141228Z (11/14/2016 09:12:28)
Entry State:             activated

102


New version:
389-ds-base-1.3.5.10-12.el7_3.x86_64

[0 root@qeos-210 ~]# ldapsearch -D cn=tuser,ou=People,dc=example,dc=com -w Secret123 -b dc=example,dc=com
ldap_bind: Constraint violation (19)
	additional info: Account inactivity limit exceeded. Contact system administrator to reset.
[0 root@qeos-210 ~]# ns-accountstatus.pl -D cn=Directory\ Manager -w Secret123 -I cn=tuser,ou=People,dc=example,dc=com -V; echo $? 
Entry:                   cn=tuser,ou=People,dc=example,dc=com
Entry Creation Date:     20161114134622Z (11/14/2016 08:46:22)
Entry Modification Date: 20161114141206Z (11/14/2016 09:12:06)
Last Login Date:         20161114141228Z (11/14/2016 09:12:28)
Inactivity Limit:        120 seconds (2 minutes)
Time Until Inactive:     -
Time Since Inactivated:  692 seconds (11 minutes, 32 seconds)
Entry State:             inactivated (inactivity limit exceeded)

103


Marking as VERIFIED.

Comment 7 Sankar Ramalingam 2016-11-14 15:11:16 UTC

Adding my comments...

Enabled account policy plugin and added few users to suffix. Then, I ran ns-activate.pl, ns-inactivate.pl and ns-accocuntstatus.pl. All of them showed the correct status.

[root@dell-pe-fc630-01 ~]# PORT=19089; /usr/bin/ldapsearch -LLL  -x -p $PORT -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=config,cn=Account Policy Plugin,cn=plugins,cn=config" |egrep 'accountInactivityLimit|alwaysrecordlogin'
alwaysrecordlogin: yes
limitattrname: accountInactivityLimit
accountInactivityLimit: 120

[root@dell-pe-fc630-01 ~]# systemctl restart dirsrv.target

[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=testusr3,ou=people,dc=example,dc=com"; ns-activate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=testusr3,ou=people,dc=example,dc=com already activated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# echo $?
100
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=testusr3,ou=people,dc=example,dc=com"; ns-inactivate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=testusr3,ou=people,dc=example,dc=com inactivated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# echo $?
0
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=testusr3,ou=people,dc=example,dc=com"; ns-inactivate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=testusr3,ou=people,dc=example,dc=com already inactivated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# echo $?
100
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=testusr3,ou=people,dc=example,dc=com"; ns-accountstatus.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=testusr3,ou=people,dc=example,dc=com - inactivated (directly locked).
[root@dell-pe-fc630-01 MMR_WINSYNC]# echo $?
103
[root@dell-pe-fc630-01 MMR_WINSYNC]# 
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=testusr3,ou=people,dc=example,dc=com"; ns-activate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=testusr3,ou=people,dc=example,dc=com activated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=testusr3,ou=people,dc=example,dc=com"; ns-accountstatus.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=testusr3,ou=people,dc=example,dc=com - inactivated (inactivity limit exceeded).

[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=yestusr3,ou=people,dc=example,dc=com"; ns-activate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=yestusr3,ou=people,dc=example,dc=com activated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=yestusr3,ou=people,dc=example,dc=com"; ns-activate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=yestusr3,ou=people,dc=example,dc=com already activated.
[root@dell-pe-fc630-01 MMR_WINSYNC]#  PORT=19089; USER3="uid=yestusr3,ou=people,dc=example,dc=com"; /usr/bin/ldapsearch -x -p $PORT -h localhost -D "$USER3" -w Secret123 -b "$USER3"
ldap_bind: Constraint violation (19)
	additional info: Account inactivity limit exceeded. Contact system administrator to reset.
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19089; USER3="uid=yestusr3,ou=people,dc=example,dc=com"; ns-accountstatus.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=yestusr3,ou=people,dc=example,dc=com - inactivated (inactivity limit exceeded).

Build tested:
[root@dell-pe-fc630-01 MMR_WINSYNC]# rpm -qa |grep -i 389-ds
389-ds-base-libs-1.3.5.10-12.el7_3.x86_64
389-ds-base-devel-1.3.5.10-12.el7_3.x86_64
389-ds-base-1.3.5.10-12.el7_3.x86_64

Comment 8 Sankar Ramalingam 2016-11-14 15:23:55 UTC

But, no account policy plugin configured, the ns-activate.pl shows exit status "0" for users which are activated already. Its supposed to be returning 100 for already activated users. This issue seems to be not fixed, though!.

[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19039; USER3="uid=yestusr3,ou=people,dc=example,dc=com"; ns-inactivate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=yestusr3,ou=people,dc=example,dc=com inactivated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19039; USER3="uid=yestusr3,ou=people,dc=example,dc=com"; ns-inactivate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=yestusr3,ou=people,dc=example,dc=com already inactivated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# echo $?
100
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19039; USER3="uid=yestusr3,ou=people,dc=example,dc=com"; ns-activate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=yestusr3,ou=people,dc=example,dc=com activated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# echo $?
0
[root@dell-pe-fc630-01 MMR_WINSYNC]# PORT=19039; USER3="uid=yestusr3,ou=people,dc=example,dc=com"; ns-activate.pl -D "cn=Directory Manager" -w Secret123 -h localhost -p $PORT  -Z testinst2 -I $USER3 
uid=yestusr3,ou=people,dc=example,dc=com activated.
[root@dell-pe-fc630-01 MMR_WINSYNC]# echo $?
0

Comment 11 errata-xmlrpc 2016-12-06 17:04:18 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2879.html

Note You need to log in before you can comment on or make changes to this bug.