Description of problem: when creating Account Policy plug-in configuration entry stateAttrName can be either lastLoginTime or createTimestamp. As a part of customer security compliancy, we are required to support both account inactivity and expiration. This is an urgent requirement which we are trying to realise through RHDS. Version-Release number of selected component (if applicable): RHDS 11. How reproducible: 20.10.2. Account Inactivity and Account Expiration https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/account-policy-plugin Actual results: - The alternate attribute option is a fallback when the primary attribute does not exist. - You can set a secondary attribute in altStateAttrName, that is checked if the primary one defined in stateAttrName does not exist" Expected results: As a part of customer security compliance, we are required to support both account inactivity and expiration. Additional info:
*** Bug 2174160 has been marked as a duplicate of this bug. ***
Upstream ticket: https://github.com/389ds/389-ds-base/issues/5749
Design Doc: https://www.port389.org/docs/389ds/design/account-policy-inactivity-and-expiration-design.html
============================================================================================================ test session starts ============================================================================================================= platform linux -- Python 3.9.17, pytest-7.4.2, pluggy-0.13.1 -- /usr/bin/python3 cachedir: .pytest_cache metadata: {'Python': '3.9.17', 'Platform': 'Linux-5.14.0-362.2.1.el9_3.x86_64-x86_64-with-glibc2.34', 'Packages': {'pytest': '7.4.2', 'pluggy': '0.13.1'}, 'Plugins': {'metadata': '3.0.0', 'html': '4.0.1', 'libfaketime': '0.1.2', 'flaky': '3.7.0'}} 389-ds-base: 2.3.6-4.module+el9dsrv+19950+6ff0d0d4 nss: 3.90.0-3.el9_2 nspr: 4.35.0-3.el9_2 openldap: 2.6.3-1.el9 cyrus-sasl: 2.1.27-21.el9 FIPS: disabled rootdir: /mnt/tests/rhds/tests/upstream/ds/dirsrvtests configfile: pytest.ini plugins: metadata-3.0.0, html-4.0.1, libfaketime-0.1.2, flaky-3.7.0 collected 1 item dirsrvtests/tests/suites/plugins/accpol_check_all_state_attrs_test.py::test_inactivty_and_expiration PASSED [100%] ============================================================================================================= 1 passed in 37.51s ============================================================================================================= Marking as VERIFIED.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (redhat-ds:12 bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2023:7429