dirsrvtests/tests/tickets/ticket548_test.py | 7 +
ldap/servers/slapd/pw.c | 99 +++++++++++-----------------
2 files changed, 48 insertions(+), 58 deletions(-)
New commits:
commit b9e565df5d304ba9fb516b987ad62480590a5845
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 11 15:14:07 2017 -0800
Ticket #49082 - Adjusted the CI test case to the fix.
Description: Fix password expiration related shadow attributes
(cherry picked from commit 5a6a5a18d0458bd147af57a06158245f329ddba3)
diff --git a/dirsrvtests/tests/tickets/ticket548_test.py
b/dirsrvtests/tests/tickets/ticket548_test.py
index a8562c2..b0feff4 100644
--- a/dirsrvtests/tests/tickets/ticket548_test.py
+++ b/dirsrvtests/tests/tickets/ticket548_test.py
@@ -95,6 +95,13 @@ def set_global_pwpolicy(topology, min_=1, max_=10, warn=3):
log.error('Failed to set passwordMinAge: error ' +
e.message['desc'])
assert False
+ log.info(" Set global password Expiration -- on\n")
+ try:
+ topology_st.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE,
'passwordExp', 'on')])
+ except ldap.LDAPError as e:
+ log.error('Failed to set passwordExp: error ' +
e.message['desc'])
+ assert False
+
log.info(" Set global password Max Age -- %s days\n" % max_)
try:
topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE,
'passwordMaxAge', '%s' % max_secs)])
commit faae0fa5a4a6b3d590c1a9e068d9436965cc49c9
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 11 15:04:42 2017 -0800
Ticket #49082 - Fix password expiration related shadow attributes
The original patch was provided by Gordon Messmer (gordon.messmer(a)gmail.com)
with the description:
Bug description:
Shadow attributes (in /etc/shadow and in LDAP) are typically unset when no
policy is in place. 389-ds will incorrectly return values (possibly set to 0)
when there is no policy.
Fix description:
Only auto-fill shadow attributes when a password policy is available. These
are empty when no policy is in place.
Don't auto-fill expiration related shadow attributes if passwords never expire.
Reviewed by William Brown <wibrown(a)redhat.com> (Thanks!!).
(cherry picked from commit 5bcd966b73708f6b558f01e6b11a7a11e8d3b126)
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index ce1ca2a..30a2cb9 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -2802,7 +2802,7 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
{
const char *dn = NULL;
passwdPolicy *pwpolicy = NULL;
- long long shadowval = 0;
+ long long shadowval = -1;
Slapi_Mods *smods = NULL;
LDAPMod **mods;
long long sval;
@@ -2840,64 +2840,66 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
if (shadowval > _MAX_SHADOW) {
shadowval = _MAX_SHADOW;
}
- } else {
- shadowval = 0;
}
- shmin = slapi_entry_attr_get_charptr(*e, "shadowMin");
- if (shmin) {
- sval = strtoll(shmin, NULL, 0);
- if (sval != shadowval) {
- slapi_ch_free_string(&shmin);
- shmin = slapi_ch_smprintf("%lld", shadowval);
+ if (shadowval > 0) {
+ shmin = slapi_entry_attr_get_charptr(*e, "shadowMin");
+ if (shmin) {
+ sval = strtoll(shmin, NULL, 0);
+ if (sval != shadowval) {
+ slapi_ch_free_string(&shmin);
+ shmin = slapi_ch_smprintf("%lld", shadowval);
+ mod_num++;
+ }
+ } else {
mod_num++;
+ shmin = slapi_ch_smprintf("%lld", shadowval);
}
- } else {
- mod_num++;
- shmin = slapi_ch_smprintf("%lld", shadowval);
}
/* shadowMax - the maximum number of days for which the user password remains valid.
*/
- if (pwpolicy->pw_maxage > 0) {
+ shadowval = -1;
+ if (pwpolicy->pw_exp == 1 && pwpolicy->pw_maxage > 0) {
shadowval = pwpolicy->pw_maxage / _SEC_PER_DAY;
if (shadowval > _MAX_SHADOW) {
shadowval = _MAX_SHADOW;
}
- } else {
- shadowval = _MAX_SHADOW;
}
- shmax = slapi_entry_attr_get_charptr(*e, "shadowMax");
- if (shmax) {
- sval = strtoll(shmax, NULL, 0);
- if (sval != shadowval) {
- slapi_ch_free_string(&shmax);
- shmax = slapi_ch_smprintf("%lld", shadowval);
+ if (shadowval > 0) {
+ shmax = slapi_entry_attr_get_charptr(*e, "shadowMax");
+ if (shmax) {
+ sval = strtoll(shmax, NULL, 0);
+ if (sval != shadowval) {
+ slapi_ch_free_string(&shmax);
+ shmax = slapi_ch_smprintf("%lld", shadowval);
+ mod_num++;
+ }
+ } else {
mod_num++;
+ shmax = slapi_ch_smprintf("%lld", shadowval);
}
- } else {
- mod_num++;
- shmax = slapi_ch_smprintf("%lld", shadowval);
}
/* shadowWarning - the number of days of advance warning given to the user before the
user password expires. */
- if (pwpolicy->pw_warning > 0) {
+ shadowval = -1;
+ if (pwpolicy->pw_exp == 1 && pwpolicy->pw_warning > 0) {
shadowval = pwpolicy->pw_warning / _SEC_PER_DAY;
if (shadowval > _MAX_SHADOW) {
shadowval = _MAX_SHADOW;
}
- } else {
- shadowval = 0;
}
- shwarn = slapi_entry_attr_get_charptr(*e, "shadowWarning");
- if (shwarn) {
- sval = strtoll(shwarn, NULL, 0);
- if (sval != shadowval) {
- slapi_ch_free_string(&shwarn);
- shwarn = slapi_ch_smprintf("%lld", shadowval);
+ if (shadowval > 0) {
+ shwarn = slapi_entry_attr_get_charptr(*e, "shadowWarning");
+ if (shwarn) {
+ sval = strtoll(shwarn, NULL, 0);
+ if (sval != shadowval) {
+ slapi_ch_free_string(&shwarn);
+ shwarn = slapi_ch_smprintf("%lld", shadowval);
+ mod_num++;
+ }
+ } else {
mod_num++;
+ shwarn = slapi_ch_smprintf("%lld", shadowval);
}
- } else {
- mod_num++;
- shwarn = slapi_ch_smprintf("%lld", shadowval);
}
smods = slapi_mods_new();
commit 2ca12fc5b79dbbb8889eba6da7b4ce59cd6cb86d
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 11 14:14:40 2017 -0800
Ticket #49080 - shadowExpire should not be a calculated value
Description: Reverting the changes made on shadowExpire in the ticket 548.
Thanks to Gordon Messmer (gordon.messmer(a)gmail.com) for providing the original patch.
Reviewed by William Brown <wibrown(a)redhat.com> (Thanks!!).
(cherry picked from commit 14eb192b0f99ae3d811fd8a5bb40713bc85ea533)
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 6f02f90..ce1ca2a 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -2803,7 +2803,6 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
const char *dn = NULL;
passwdPolicy *pwpolicy = NULL;
long long shadowval = 0;
- long long exptime = 0;
Slapi_Mods *smods = NULL;
LDAPMod **mods;
long long sval;
@@ -2811,7 +2810,6 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
char *shmin = NULL;
char *shmax = NULL;
char *shwarn = NULL;
- char *shexp = NULL;
int rc = 0;
if (!e || !*e) {
@@ -2861,7 +2859,6 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
/* shadowMax - the maximum number of days for which the user password remains valid.
*/
if (pwpolicy->pw_maxage > 0) {
shadowval = pwpolicy->pw_maxage / _SEC_PER_DAY;
- exptime = time_plus_sec(current_time(), pwpolicy->pw_maxage);
if (shadowval > _MAX_SHADOW) {
shadowval = _MAX_SHADOW;
}
@@ -2903,22 +2900,6 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
shwarn = slapi_ch_smprintf("%lld", shadowval);
}
- /* shadowExpire - the date on which the user login will be disabled. */
- if (exptime) {
- shexp = slapi_entry_attr_get_charptr(*e, "shadowExpire");
- exptime /= _SEC_PER_DAY;
- if (shexp) {
- sval = strtoll(shexp, NULL, 0);
- if (sval != exptime) {
- slapi_ch_free_string(&shexp);
- shexp = slapi_ch_smprintf("%lld", exptime);
- mod_num++;
- }
- } else {
- mod_num++;
- shexp = slapi_ch_smprintf("%lld", exptime);
- }
- }
smods = slapi_mods_new();
slapi_mods_init(smods, mod_num);
if (shmin) {
@@ -2933,10 +2914,6 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
slapi_mods_add(smods, LDAP_MOD_REPLACE, "shadowWarning",
strlen(shwarn), shwarn);
slapi_ch_free_string(&shwarn);
}
- if (shexp) {
- slapi_mods_add(smods, LDAP_MOD_REPLACE, "shadowExpire", strlen(shexp),
shexp);
- slapi_ch_free_string(&shexp);
- }
/* Apply the mods to create the resulting entry. */
mods = slapi_mods_get_ldapmods_byref(smods);
if (mods) {
@@ -2947,11 +2924,15 @@ add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry **e)
}
slapi_mods_free(&smods);
-#if 0 /* These 2 attributes are no need (or not able) to auto-fill. */
+#if 0 /* These 3 attributes are no need (or not able) to auto-fill. */
/*
* shadowInactive - the number of days of inactivity allowed for the user.
* Password Policy does not have the corresponding parameter.
*
+ * shadowExpire - the number of days since Jan 1, 1970 after which the
+ * account, not the password, will expire. This is not affected by the
+ * Password Policy.
+ *
* shadowFlag - not currently in use.
*/
#endif