Bug 703316 - Fine Grained Password policy: number of passwordInHistory is one less.
Summary: Fine Grained Password policy: number of passwordInHistory is one less.
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: 389
Classification: Retired
Component: Security - Password Policy
Version: 1.2.8
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Noriko Hosoi
QA Contact: Chandrasekar Kannan
URL:
Whiteboard:
Depends On:
Blocks: 512820
TreeView+ depends on / blocked
 
Reported: 2011-05-10 00:06 UTC by Noriko Hosoi
Modified: 2015-01-04 23:48 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-05-31 20:48:58 UTC


Attachments (Terms of Use)

Description Noriko Hosoi 2011-05-10 00:06:48 UTC
Description of problem:

Steps:
passwordInHistory: 3

Original password is testpassword --> passwd-001
$ ldapmodify -x -h localhost -p 389 -D 'uid=nd,ou=People,dc=example,dc=com' -w testpassword
dn: uid=nd, ou=People, dc=example, dc=com
changetype: modify
replace: userPassword
userPassword: passwd-001

Repeat this as follows:
passwd-001 --> passwd-002
passwd-002 --> passwd-003

$ ldapmodify -x -h localhost -p 389 -D 'uid=nd,ou=People,dc=example,dc=com' -w passwd-003
dn: uid=nd, ou=People, dc=example, dc=com
changetype: modify
replace: userPassword
userPassword: testpassword

modifying entry "uid=nd, ou=People, dc=example, dc=com"
ldap_modify: Constraint violation (19)
	additional info: password in history

Change password one more time.
$ ldapmodify -x -h localhost -p 389 -D 'uid=nd,ou=People,dc=example,dc=com' -w passwd-003
dn: uid=nd, ou=People, dc=example, dc=com
changetype: modify
replace: userPassword
userPassword: passwd-004

Then, try the original password.  It works.
$ ldapmodify -x -h localhost -p 389 -D 'uid=nd,ou=People,dc=example,dc=com' -w passwd-004
dn: uid=nd, ou=People, dc=example, dc=com
changetype: modify
replace: userPassword
userPassword: testpassword

modifying entry "uid=nd, ou=People, dc=example, dc=com"

http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Configuration_and_Command-Line_Tool_Reference/Core_Server_Configuration_Reference.html#cnconfig-passwordInHistory_Number_of_Passwords_to_Remember
3.1.1.127. passwordInHistory (Number of Passwords to Remember)
Indicates the number of passwords the Directory Server stores in history. Passwords that are stored in history cannot be reused by users.

Comment 4 Noriko Hosoi 2011-05-31 20:48:58 UTC
It turned out DS is behaving correctly.  Closing as NOTABUG.


Note You need to log in before you can comment on or make changes to this bug.