dirsrvtests/tickets/ticket142_test.py | 330 +++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 2
ldap/servers/slapd/back-ldbm/dblayer.c | 13 +
ldap/servers/slapd/libglobs.c | 34 +++
ldap/servers/slapd/proto-slap.h | 2
ldap/servers/slapd/pw.c | 27 ++
ldap/servers/slapd/slap.h | 3
7 files changed, 405 insertions(+), 6 deletions(-)
New commits:
commit f5b9053e3d408c9b81d5ac537bd772360515a641
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Dec 16 17:49:34 2015 -0800
Ticket #48244 - No validation check for the value for nsslapd-db-locks
Description: Added a validation check for the value for nsslapd-db-locks.
The default value is 10000 and now the lower value is set, it is set back
to the default value with this error message:
[..] - New max db lock count is too small. Resetting it to the default value 10000.
https://fedorahosted.org/389/ticket/48244
Reviewed by firstyear(a)redhat.com (Thank you, William!!)
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c
b/ldap/servers/slapd/back-ldbm/dblayer.c
index 9168c8c..e65f3cf 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -1661,8 +1661,19 @@ dblayer_start(struct ldbminfo *li, int dbmode)
priv->dblayer_previous_ncache, priv->dblayer_ncache, 0);
}
if (priv->dblayer_lock_config != priv->dblayer_previous_lock_config) {
- LDAPDebug(LDAP_DEBUG_ANY, "resizing max db lock count: %d ->
%d\n",
+ /*
+ * The default value of nsslapd-db-locks is 10000.
+ * We don't allow lower value than that.
+ */
+ if (priv->dblayer_lock_config <= 10000) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "New max db lock count is too small.
"
+ "Resetting it to the default value 10000.\n");
+ priv->dblayer_lock_config = 10000;
+ }
+ if (priv->dblayer_lock_config != priv->dblayer_previous_lock_config) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing max db lock count: %d ->
%d\n",
priv->dblayer_previous_lock_config,
priv->dblayer_lock_config, 0);
+ }
}
dblayer_reset_env(li);
/*
commit 1c3fa84d3ef74c660ee0743e2d5516d066f948b7
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Dec 16 10:42:08 2015 -0800
Ticket 142 - CI test: added test cases for ticket 142
Description: [RFE] Default password syntax settings don't work with fine-grained
policies
diff --git a/dirsrvtests/tickets/ticket142_test.py
b/dirsrvtests/tickets/ticket142_test.py
new file mode 100644
index 0000000..53cb82f
--- /dev/null
+++ b/dirsrvtests/tickets/ticket142_test.py
@@ -0,0 +1,330 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2015 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+#
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+import shutil
+from lib389 import DirSrv, Entry, tools
+from lib389 import DirSrvTools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+CONFIG_DN = 'cn=config'
+OU_PEOPLE = 'ou=People,' + DEFAULT_SUFFIX
+PWP_CONTAINER = 'nsPwPolicyContainer'
+PWP_CONTAINER_DN = 'cn=' + PWP_CONTAINER + ',' + OU_PEOPLE
+PWP_ENTRY_DN = 'cn=nsPwPolicyEntry,' + OU_PEOPLE
+PWP_TEMPLATE_ENTRY_DN = 'cn=nsPwTemplateEntry,' + OU_PEOPLE
+ATTR_INHERIT_GLOBAL = 'nsslapd-pwpolicy-inherit-global'
+
+BN = 'uid=buser,' + DEFAULT_SUFFIX
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ # Here we have standalone instance up and running
+ return TopologyStandalone(standalone)
+
+
+def _header(topology, label):
+
topology.standalone.log.info("###############################################")
+ topology.standalone.log.info("####### %s" % label)
+
topology.standalone.log.info("###############################################")
+
+def check_attr_val(topology, dn, attr, expected):
+ try:
+ centry = topology.standalone.search_s(dn, ldap.SCOPE_BASE, 'cn=*')
+ if centry:
+ val = centry[0].getValue(attr)
+ if val == expected:
+ log.info('Default value of %s is %s' % (attr, expected))
+ else:
+ log.info('Default value of %s is not %s, but %s' % (attr,
expected, val))
+ assert False
+ else:
+ log.fatal('Failed to get %s' % dn)
+ assert False
+ except ldap.LDAPError as e:
+ log.fatal('Failed to search ' + dn + ': ' +
e.message['desc'])
+ assert False
+
+def _142_init(topology):
+ """
+ Set global password policy.
+ Then, set fine-grained subtree level password policy to ou=People with no password
syntax.
+ Note: do not touch nsslapd-pwpolicy-inherit-global -- off by default
+ Also, adding an ordinary bind user.
+ """
+ _header(topology, 'Testing Ticket 142 - Default password syntax settings do not
work with fine-grained policies')
+
+ log.info("Setting global password policy with password syntax.")
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE,
'nsslapd-pwpolicy-local', 'on')])
+
+ log.info("Setting fine-grained password policy.")
+ topology.standalone.add_s(Entry((PWP_CONTAINER_DN, {
+ 'objectclass': "top
nsContainer".split()})))
+ topology.standalone.add_s(Entry(('cn="%s",%s' % (PWP_ENTRY_DN,
PWP_CONTAINER_DN), {
+ 'objectclass': "top ldapsubentry
passwordpolicy".split()})))
+ topology.standalone.add_s(Entry(('cn="%s",%s' %
(PWP_TEMPLATE_ENTRY_DN, PWP_CONTAINER_DN), {
+ 'objectclass': "top ldapsubentry
costemplate".split(),
+ 'pwdpolicysubentry':
'cn="%s",%s' % (PWP_ENTRY_DN, PWP_CONTAINER_DN)})))
+ topology.standalone.add_s(Entry(('cn=nsPwPolicy_CoS,%s' % OU_PEOPLE, {
+ 'objectclass': "top ldapsubentry
cosSuperDefinition cosPointerDefinition".split(),
+ 'cosTemplateDn':
'cn="%s",%s' % (PWP_TEMPLATE_ENTRY_DN, PWP_CONTAINER_DN),
+ 'cosAttribute': 'pwdpolicysubentry
default operational-default'})))
+
+ log.info(" with the default settings.")
+ topology.standalone.modify_s('cn="%s",%s' % (PWP_ENTRY_DN,
PWP_CONTAINER_DN),
+ [(ldap.MOD_REPLACE, 'passwordMustChange',
'off'),
+ (ldap.MOD_REPLACE, 'passwordExp',
'off'),
+ (ldap.MOD_REPLACE, 'passwordMinAge',
'0'),
+ (ldap.MOD_REPLACE, 'passwordChange',
'off'),
+ (ldap.MOD_REPLACE, 'passwordStorageScheme',
'ssha')])
+
+ check_attr_val(topology, CONFIG_DN, ATTR_INHERIT_GLOBAL, 'off')
+ check_attr_val(topology, CONFIG_DN, 'passwordCheckSyntax', 'off')
+
+ log.info('Adding a bind user.')
+ topology.standalone.add_s(Entry((BN,
+ {'objectclass': "top person
organizationalPerson inetOrgPerson".split(),
+ 'cn': 'bind user',
+ 'sn': 'bind user',
+ 'userPassword': PASSWORD})))
+
+ log.info('Adding an aci for the bind user.')
+ topology.standalone.modify_s(OU_PEOPLE,
+ [(ldap.MOD_ADD,
+ 'aci',
+ '(targetattr="*")(version 3.0; acl
"pwp test"; allow (all) userdn="ldap:///%s";)' % BN)])
+
+
+def _142_run_0(topology):
+ """
+ Make sure an entry added to ou=people has no password syntax restrictions.
+ """
+ _header(topology, 'Case 0 - Make sure an entry added to ou=people has no password
syntax restrictions.')
+
+ topology.standalone.simple_bind_s(BN, PASSWORD)
+ try:
+ topology.standalone.add_s(Entry(('cn=test0,%s' % OU_PEOPLE,
+ {'objectclass': "top person
organizationalPerson inetOrgPerson".split(),
+ 'cn': 'test0',
+ 'sn': 'test0',
+ 'userPassword': 'short'})))
+ except ldap.LDAPError as e:
+ log.fatal('Failed to add cn=test0 with userPassword: short: ' +
e.message['desc'])
+ assert False
+
+ log.info('PASSED')
+
+
+def _142_run_1(topology):
+ """
+ Set 'nsslapd-pwpolicy-inherit-global: on'
+ But passwordCheckSyntax is still off.
+ Make sure an entry added to ou=people has the global password syntax restrictions.
+ """
+ _header(topology, 'Case 1 - Make sure an entry added to ou=people has no password
syntax restrictions.')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, ATTR_INHERIT_GLOBAL,
'on')])
+ check_attr_val(topology, CONFIG_DN, ATTR_INHERIT_GLOBAL, 'on')
+ check_attr_val(topology, CONFIG_DN, 'passwordCheckSyntax', 'off')
+ topology.standalone.simple_bind_s(BN, PASSWORD)
+ try:
+ topology.standalone.add_s(Entry(('cn=test1,%s' % OU_PEOPLE,
+ {'objectclass': "top person
organizationalPerson inetOrgPerson".split(),
+ 'cn': 'test1',
+ 'sn': 'test1',
+ 'userPassword': 'short'})))
+ except ldap.LDAPError as e:
+ log.fatal('Failed to add cn=test1 with userPassword: short: ' +
e.message['desc'])
+ assert False
+
+ log.info('PASSED')
+
+
+def _142_run_2(topology):
+ """
+ Set 'passwordCheckSyntax: on'
+ Set 'passwordMinLength: 9' for testing
+ Make sure an entry added to ou=people has the global password syntax restrictions.
+ """
+ _header(topology, 'Case 2 - Make sure an entry added to ou=people has the global
password syntax restrictions.')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(CONFIG_DN,
+ [(ldap.MOD_REPLACE, 'passwordCheckSyntax',
'on'),
+ (ldap.MOD_REPLACE, 'passwordMinLength',
'9')])
+ check_attr_val(topology, CONFIG_DN, ATTR_INHERIT_GLOBAL, 'on')
+ check_attr_val(topology, CONFIG_DN, 'passwordCheckSyntax', 'on')
+ topology.standalone.simple_bind_s(BN, PASSWORD)
+ failed_as_expected = False
+ try:
+ topology.standalone.add_s(Entry(('cn=test2,%s' % OU_PEOPLE,
+ {'objectclass': "top person
organizationalPerson inetOrgPerson".split(),
+ 'cn': 'test2',
+ 'sn': 'test2',
+ 'userPassword': 'Abcd2345'})))
+ except ldap.LDAPError as e:
+ log.info('Adding cn=test2 with "userPassword: Abcd2345" was
expectedly rejected: ' + e.message['desc'])
+ failed_as_expected = True
+
+ if not failed_as_expected:
+ log.fatal('Adding cn=test2 with "userPassword: Abcd2345" was
unexpectedly successful despite of short password.')
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry(('cn=test2,%s' % OU_PEOPLE,
+ {'objectclass': "top person
organizationalPerson inetOrgPerson".split(),
+ 'cn': 'test2',
+ 'sn': 'test2',
+ 'userPassword':
'Abcd23456'})))
+ except ldap.LDAPError as e:
+ log.fatal('Adding cn=test2 with "userPassword: Abcd23456" failed:
' + e.message['desc'])
+ assert False
+
+ log.info('PASSED')
+
+
+def _142_run_3(topology):
+ """
+ Set 'passwordCheckSyntax: on'
+ Set 'nsslapd-pwpolicy-inherit-global: off'
+ Make sure an entry added to ou=people has no syntax restrictions.
+ """
+ _header(topology, 'Case 3 - Make sure an entry added to ou=people has no password
syntax restrictions.')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(CONFIG_DN,
+ [(ldap.MOD_REPLACE, ATTR_INHERIT_GLOBAL,
'off')])
+ check_attr_val(topology, CONFIG_DN, ATTR_INHERIT_GLOBAL, 'off')
+ check_attr_val(topology, CONFIG_DN, 'passwordCheckSyntax', 'on')
+ topology.standalone.simple_bind_s(BN, PASSWORD)
+ try:
+ topology.standalone.add_s(Entry(('cn=test3,%s' % OU_PEOPLE,
+ {'objectclass': "top person
organizationalPerson inetOrgPerson".split(),
+ 'cn': 'test3',
+ 'sn': 'test3',
+ 'userPassword': 'Abcd3456'})))
+ except ldap.LDAPError as e:
+ log.fatal('Adding cn=test3 with "userPassword: Abcd3456" failed:
' + e.message['desc'])
+ assert False
+
+ log.info('PASSED')
+
+
+def _142_run_4(topology):
+ """
+ Set 'passwordCheckSyntax: on'
+ Set 'nsslapd-pwpolicy-inherit-global: on'
+ Set password syntax to fine-grained password policy to check it overrides the global
settings.
+ """
+ _header(topology, 'Case 4 - Make sure an entry added to ou=people follows the
fine-grained password syntax restrictions.')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(CONFIG_DN,
+ [(ldap.MOD_REPLACE, ATTR_INHERIT_GLOBAL,
'on')])
+ check_attr_val(topology, CONFIG_DN, ATTR_INHERIT_GLOBAL, 'on')
+ check_attr_val(topology, CONFIG_DN, 'passwordCheckSyntax', 'on')
+ topology.standalone.modify_s('cn="%s",%s' % (PWP_ENTRY_DN,
PWP_CONTAINER_DN),
+ [(ldap.MOD_REPLACE, 'passwordMinLength',
'5'),
+ (ldap.MOD_REPLACE, 'passwordMinCategories',
'2')])
+ try:
+ topology.standalone.add_s(Entry(('cn=test4,%s' % OU_PEOPLE,
+ {'objectclass': "top person
organizationalPerson inetOrgPerson".split(),
+ 'cn': 'test4',
+ 'sn': 'test4',
+ 'userPassword': 'Abcd4'})))
+ except ldap.LDAPError as e:
+ log.fatal('Adding cn=test4 with "userPassword: Abcd4" failed: '
+ e.message['desc'])
+ assert False
+
+ log.info('PASSED')
+
+
+def _142_final(topology):
+ topology.standalone.delete()
+ log.info('All PASSED')
+
+
+def test_ticket142(topology):
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler
(xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '(a)pytest.fixture' line before
'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ _142_init(topology)
+
+ _142_run_0(topology)
+ _142_run_1(topology)
+ _142_run_2(topology)
+ _142_run_3(topology)
+ _142_run_4(topology)
+
+ _142_final(topology)
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
commit af1fc5e7711185d921ffb67f6d4a870dfa3bbcde
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Dec 15 13:37:27 2015 -0800
Ticket #142 - [RFE] Default password syntax settings don't work with fine-grained
policies
Description: When a fine-grained password syntax is not set, there is no
syntax restriction for the passwords to be added or modified even though
the global password syntax is configured.
This patch introducing a config parameter:
cn=config.
nsslapd-pwpolicy-inherit-global: on | off
If on, the fine-grained password syntax inherits the global password
syntax if the global one is configured.
If off, the inheritance does not occur. This is the current behaviour.
By default, it is off.
https://fedorahosted.org/389/ticket/142
Reviewed by firstyear(a)redhat.com (Thank you, William!!)
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index e0b841d..db90ffa 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -2329,7 +2329,7 @@ static int cos_cache_query_attr(cos_cache *ptheCache, vattr_context
*context,
/* now for the tests */
/* would we be allowed to supply this attribute if we had one? */
- if(entry_has_value && pAttr->attr_override == 0 &&
pAttr->attr_operational == 0)
+ if (entry_has_value && !pAttr->attr_override &&
!pAttr->attr_operational && !pAttr->attr_operational_default)
{
/* answer: no, move on to the next attribute */
attr_index++;
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 4661964..d108bf3 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -186,6 +186,7 @@ slapi_onoff_t init_csnlogging;
slapi_onoff_t init_pw_unlock;
slapi_onoff_t init_pw_must_change;
slapi_onoff_t init_pwpolicy_local;
+slapi_onoff_t init_pwpolicy_inherit_global;
slapi_onoff_t init_pw_lockout;
slapi_onoff_t init_pw_history;
slapi_onoff_t init_pw_is_global_policy;
@@ -406,6 +407,10 @@ static struct config_get_and_set {
NULL, 0,
(void**)&global_slapdFrontendConfig.pwpolicy_local,
CONFIG_ON_OFF, NULL, &init_pwpolicy_local},
+ {CONFIG_PWPOLICY_INHERIT_GLOBAL_ATTRIBUTE, config_set_pwpolicy_inherit_global,
+ NULL, 0,
+ (void**)&global_slapdFrontendConfig.pwpolicy_inherit_global,
+ CONFIG_ON_OFF, NULL, &init_pwpolicy_inherit_global},
{CONFIG_AUDITLOG_MAXLOGDISKSPACE_ATTRIBUTE, NULL,
log_set_maxdiskspace, SLAPD_AUDIT_LOG,
(void**)&global_slapdFrontendConfig.auditlog_maxdiskspace,
@@ -1506,6 +1511,7 @@ FrontendConfig_init () {
init_readonly = cfg->readonly = LDAP_OFF;
init_pwpolicy_local = cfg->pwpolicy_local = LDAP_OFF;
+ init_pwpolicy_inherit_global = cfg->pwpolicy_inherit_global = LDAP_OFF;
init_pw_change = cfg->pw_policy.pw_change = LDAP_ON;
init_pw_must_change = cfg->pw_policy.pw_must_change = LDAP_OFF;
init_allow_hashed_pw = cfg->allow_hashed_pw = LDAP_OFF;
@@ -2581,7 +2587,6 @@ config_set_pw_history( const char *attrname, char *value, char
*errorbuf, int ap
}
-
int
config_set_pw_must_change( const char *attrname, char *value, char *errorbuf, int apply )
{
int retVal = LDAP_SUCCESS;
@@ -2618,6 +2623,23 @@ config_set_pwpolicy_local( const char *attrname, char *value, char
*errorbuf, in
return retVal;
}
+
+int
+config_set_pwpolicy_inherit_global(const char *attrname, char *value, char *errorbuf, int
apply)
+{
+ int retVal = LDAP_SUCCESS;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+
+ retVal = config_set_onoff (attrname,
+ value,
+ &(slapdFrontendConfig->pwpolicy_inherit_global),
+ errorbuf,
+ apply);
+
+ return retVal;
+}
+
+
int
config_set_allow_hashed_pw( const char *attrname, char *value, char *errorbuf, int apply
) {
int retVal = LDAP_SUCCESS;
@@ -5712,6 +5734,16 @@ config_get_pw_warning() {
}
int
+config_get_pwpolicy_inherit_global()
+{
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ int retVal;
+
+ retVal = slapdFrontendConfig->pwpolicy_inherit_global;
+ return retVal;
+}
+
+int
config_get_errorlog_level(){
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
int retVal;
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 0547bc7..7d965b0 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -301,6 +301,7 @@ int config_set_pw_change(const char *attrname, char *value, char
*errorbuf, int
int config_set_pw_must_change(const char *attrname, char *value, char *errorbuf, int
apply );
int config_set_pwpolicy_local(const char *attrname, char *value, char *errorbuf, int
apply );
int config_set_allow_hashed_pw( const char *attrname, char *value, char *errorbuf, int
apply );
+int config_set_pwpolicy_inherit_global(const char *attrname, char *value, char
*errorbuf, int apply );
int config_set_pw_syntax(const char *attrname, char *value, char *errorbuf, int apply
);
int config_set_pw_minlength(const char *attrname, char *value, char *errorbuf, int apply
);
int config_set_pw_mindigits(const char *attrname, char *value, char *errorbuf, int apply
);
@@ -444,6 +445,7 @@ int config_get_pw_exp();
int config_get_pw_unlock();
int config_get_pw_lockout();
int config_get_pw_gracelimit();
+int config_get_pwpolicy_inherit_global();
int config_get_lastmod();
int config_get_nagle();
int config_get_accesscontrol();
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 3985c2b..69756f3 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -853,7 +853,7 @@ check_pw_syntax_ext ( Slapi_PBlock *pb, const Slapi_DN *sdn,
Slapi_Value **vals,
}
}
- if ( pwpolicy->pw_syntax == 1 ) {
+ if ( pwpolicy->pw_syntax == LDAP_ON ) {
for ( i = 0; vals[ i ] != NULL; ++i ) {
int syntax_violation = 0;
int num_digits = 0;
@@ -1057,7 +1057,7 @@ retry:
}
/* check for trivial words if syntax checking is enabled */
- if ( pwpolicy->pw_syntax == 1 ) {
+ if ( pwpolicy->pw_syntax == LDAP_ON ) {
/* e is null if this is an add operation*/
if ( check_trivial_words ( pb, e, vals, "uid",
pwpolicy->pw_mintokenlength, smods ) == 1 ||
check_trivial_words ( pb, e, vals, "cn", pwpolicy->pw_mintokenlength,
smods ) == 1 ||
@@ -1999,7 +1999,28 @@ new_passwdPolicy(Slapi_PBlock *pb, const char *dn)
if (pw_entry) {
slapi_entry_free(pw_entry);
}
- if(pb){
+ if (LDAP_ON != pwdpolicy->pw_syntax) {
+ passwdPolicy *g_pwdpolicy = &(slapdFrontendConfig->pw_policy);
+ /*
+ * When the fine-grained password policy does not set the
+ * password syntax, get the syntax from the global
+ * policy if nsslapd-pwpolicy-inherit-global is on.
+ */
+ if ((LDAP_ON == g_pwdpolicy->pw_syntax) &&
config_get_pwpolicy_inherit_global()) {
+ pwdpolicy->pw_minlength = g_pwdpolicy->pw_minlength;
+ pwdpolicy->pw_mindigits = g_pwdpolicy->pw_mindigits;
+ pwdpolicy->pw_minalphas = g_pwdpolicy->pw_minalphas;
+ pwdpolicy->pw_minuppers = g_pwdpolicy->pw_minuppers;
+ pwdpolicy->pw_minlowers = g_pwdpolicy->pw_minlowers;
+ pwdpolicy->pw_minspecials = g_pwdpolicy->pw_minspecials;
+ pwdpolicy->pw_min8bit = g_pwdpolicy->pw_min8bit;
+ pwdpolicy->pw_maxrepeats = g_pwdpolicy->pw_maxrepeats;
+ pwdpolicy->pw_mincategories = g_pwdpolicy->pw_mincategories;
+ pwdpolicy->pw_mintokenlength = g_pwdpolicy->pw_mintokenlength;
+ pwdpolicy->pw_syntax = LDAP_ON; /* Need to enable it to apply the default values
*/
+ }
+ }
+ if (pb) {
pb->pwdpolicy = pwdpolicy;
}
return pwdpolicy;
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 0b867ab..0474e8e 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -2013,6 +2013,7 @@ typedef struct _slapdEntryPoints {
#define CONFIG_GROUPEVALNESTLEVEL_ATTRIBUTE "nsslapd-groupevalnestlevel"
#define CONFIG_NAGLE_ATTRIBUTE "nsslapd-nagle"
#define CONFIG_PWPOLICY_LOCAL_ATTRIBUTE "nsslapd-pwpolicy-local"
+#define CONFIG_PWPOLICY_INHERIT_GLOBAL_ATTRIBUTE
"nsslapd-pwpolicy-inherit-global"
#define CONFIG_ALLOW_HASHED_PW_ATTRIBUTE "nsslapd-allow-hashed-passwords"
#define CONFIG_PW_CHANGE_ATTRIBUTE "passwordChange"
#define CONFIG_PW_MUSTCHANGE_ATTRIBUTE "passwordMustChange"
@@ -2229,8 +2230,10 @@ typedef struct _slapdFrontendConfig {
slapi_onoff_t pwpolicy_local;
slapi_onoff_t pw_is_global_policy;
+ slapi_onoff_t pwpolicy_inherit_global;
slapi_onoff_t allow_hashed_pw;
passwdPolicy pw_policy;
+ slapi_onoff_t pw_policy_inherit_global;
/* ACCESS LOG */
slapi_onoff_t accesslog_logging_enabled;