From d6d1d5d95d3aff2ca824992ecfaacc867ce32bbf Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Fri, 6 Jul 2018 09:22:51 +0300
Subject: [PATCH] ipa-pwd-extop: don't check password policy for non-Kerberos
 account set by DM or a passsync manager

Password changes performed by cn=Directory Manager are excluded from
password policy checks according to [1]. This is correctly handled by
ipa-pwd-extop in case of a normal Kerberos principal in IPA. However,
non-kerberos accounts were not excluded from the check.

As result, password updates for PKI CA admin account in o=ipaca were
failing if a password policy does not allow a password reuse. We are
re-setting the password for PKI CA admin in ipa-replica-prepare in case
the original directory manager's password was updated since creation of
`cacert.p12`.

Do password policy check for non-Kerberos accounts only if it was set by
a regular user or admin. Changes performed by a cn=Directory Manager and
passsync managers should be excluded from the policy check.

Fixes: https://pagure.io/freeipa/issue/7181
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>

[1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/html/administration_guide/user_account_management-managing_the_password_policy
---
 daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
index c62eae3341..cf1dde052f 100644
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
@@ -843,8 +843,10 @@ static int ipapwd_pre_mod(Slapi_PBlock *pb)
 
     /* if krb keys are being set by an external agent we assume password
      * policies have been properly checked already, so we check them only
-     * if no krb keys are available */
-    if (has_krb_keys == 0) {
+     * if no krb keys are available and the change is not done by a
+     * cn=Directory Manager or one of passsync managers */
+    if ((pwdop->pwdata.changetype != IPA_CHANGETYPE_DSMGR) &&
+        (has_krb_keys == 0)) {
         ret = ipapwd_CheckPolicy(&pwdop->pwdata);
         if (ret) {
             errMesg = ipapwd_error2string(ret);
