Bug 681611 - RFE: allow fine grained password policy duration attributes in days, hours, minutes, as well
RFE: allow fine grained password policy duration attributes in days, hours, m...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: 389-ds-base (Show other bugs)
6.1
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Rich Megginson
Chandrasekar Kannan
: FutureFeature, screened
Depends On: 681015 689889
Blocks: 639035 389_1.2.8 680575
  Show dependency treegraph
 
Reported: 2011-03-02 13:07 EST by Noriko Hosoi
Modified: 2015-01-04 18:46 EST (History)
6 users (show)

See Also:
Fixed In Version: 389-ds-base-1.2.8-0.6.rc1.el6
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: 681015
Environment:
Last Closed: 2011-05-19 08:42:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Noriko Hosoi 2011-03-02 13:07:33 EST
+++ This bug was initially created as a clone of Bug #681015 +++

Description of problem:
This bug fix allows global password policy duration attributes in the format of ##D|d, ##H|h, ##M|m, ##S|s.
Bug 627993 - RFE: allow global password policy duration attributes in days, hours, minutes, as well

On the other hand, the fine grained has no ability to handle such format.  Actually, there is no methods to check the invalid input to the fine grained password policy duration attributes.

$ ldapmodify ...
dn: cn=cn\3DnsPwPolicyEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,cn=nsPwPol
 icyContainer,ou=People,dc=example,dc=com
changetype: modify
replace: passwordMaxAge
passwordMaxAge: abcdefg
$ echo $?
0

--- Additional comment from nhosoi@redhat.com on 2011-02-28 17:22:47 EST ---

Created attachment 481460 [details]
git patch file (master)

Description: Adding an ability to handle ##D|d, ##H|h, ##M|m, ##S|s
format to the fine grained password policy duration attributes.

Note: when adding modifying password policy duration attributes, there is no way to verify the value.  If the value is invalid, it's found when the password is evaluated.  Without the attached patch, the password evaluation just fails without any error.  This patch logs the cause in the error log.

E.g.,

dn: cn=cn\3DnsPwPolicyEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,cn=nsPwPol
 icyContainer,ou=People,dc=example,dc=com
changetype: modify
replace: passwordMaxAge
passwordMaxAge: xyz
$ echo $?
0

$ ldapsearch -D 'uid=tuser0,ou=People,dc=example,dc=com' -w tuser0 -b "dc=example,dc=com" "(cn=*)"
ldapsearch: Password has expired.
ldap_simple_bind: Invalid credentials
ldap_simple_bind: additional info: password expired!

Error log (once the patch is applied):
[28/Feb/2011:14:15:08 -0800] - Password Policy Entrycn=cn\3DnsPwPolicyEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,cn=nsPwPolicyContainer,ou=People,dc=example,dc=com: Invalid passwordMaxAge: xyz

--- Additional comment from nhosoi@redhat.com on 2011-03-01 19:20:13 EST ---

Created attachment 481753 [details]
git patch file (master)

Description: Adding an ability to handle ##D|d, ##H|h, ##M|m, ##S|s
format to the fine grained password policy duration attributes:
  passwordMinAge, passwordMaxAge, passwordWarning,
  passwordLockoutDuration
Valid value for these duraton parameters are
  . duration in seconds with no extension
  . duration in days, hours, minutes, and seconds with extesion
    D|d, H|h, M|m, and S|s, respectively.
The value should be less than MAX_ALLOWED_TIME_IN_SECS - current_time.

--- Additional comment from rmeggins@redhat.com on 2011-03-02 10:02:38 EST ---

Comment on attachment 481753 [details]
git patch file (master)

https://bugzilla.redhat.com/attachment.cgi?id=481753&action=diff#a/ldap/servers/slapd/modify.c_sec1

this probably won't compile due to the extra comma at the end of the list

Other than that, looks good.

--- Additional comment from nhosoi@redhat.com on 2011-03-02 13:06:44 EST ---

Thanks for finding it out, Rich!  Amazingly, this compiler let me compile it!
  gcc (GCC) 4.4.5 20101112 (Red Hat 4.4.5-2)

But obviously, the comma should not be there.  I removed the comma.

Pushed to master
commit 53839a8b27e92fd04f36401a95b54a2bc1168b88

as well as to 389-ds-base-1.2.8:
commit 3e70b878da60d21c07176108cb96648546176646
Comment 3 Amita Sharma 2011-04-14 04:34:47 EDT
This bug is verified and automated in the password policy test suit.
Marking it as verified.
-Amita
Comment 4 errata-xmlrpc 2011-05-19 08:42:31 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2011-0533.html

Note You need to log in before you can comment on or make changes to this bug.