On Wed, Feb 20, 2019 at 11:54:31AM +0100, Pavel Březina wrote:
On 2/19/19 10:03 PM, Jakub Hrozek wrote:
> Thank you, I only have some minor requests for clarifications.
I updated the text.
Thank you, there are just some typos here and there, but in general I
think the page looks good. I'll let some grace period pass so others can
also submit their opinion, then I'll merge the page.
> > Problem statement
> > -----------------
> > [...]
>
> I would prefer more details here. The two servers that are often cited
> are IBM Tivoli and Oracle Directory server. I don't know if it's just
> the older versions of these servers all even recent ones, at least I
> know that with some Oracle server versions, you can enable the extended
> operation but it is not enabled by default.
I was not able to find any mention of this exop in IBM server documentation
so I suppose it is not supported.
Yes, I think so, too.
Oracle server supports it but I was not
able to find the default state.
Me neither, I just know from some RH support cases that at least some
versions didn't enable this control by default.
Change password on LDAP server that does not support Password Mofify
Extended Operation
=======================================================================================
Related ticket(s):
------------------
https://pagure.io/SSSD/sssd/issue/1314
Problem statement
-----------------
Some directory servers either do not support Password Modify Extended
Operation
(OID 1.3.6.1.4.1.4203.1.11.1, RFC 3062) for password change or this feature
is
disabled by default. SSSD is unable to perform password change on such
servers.
Even though we recommend to upgrade to servers that supports this feature,
there are still users that will benefit from SSSD being able to change
password without it.
Two example servers are IBM Tivoli Directory Server that does not support
this operation and Oracle Directory Server that may not have it enabled
by default.
Use cases
---------
* A user wants to change his/her password against LDAP that does not
support
Password Modify Extended Operation.
Overview of the solution
------------------------
Provide new configuration option ``ldap_pwmodify_mode``. This option can be
set to one of two values: ``exop``, ``ldap_modify`` having ``exop`` to be
the
default value. This will give us the ability to extend SSSD with another
method
for password change in the future if it is ever needed.
If this option is set to ``exop`` then SSSD use Password Modify extended
operation to change the password as it does now. If the value is
``ldap_modify``
then ldap_modidy operation will be used to change the password.
~~~~~
typo
Even though the ldap_modify operation uses a plain text password, the
servers
typically encrypts the userPassword attribute.
s/encrypts/hashes/?
It should be explicitly said here that even though the modify operation
would use the plain text password, the servers typically hash the
userPassword attribute.
Duplicate paragraph (now with hashed instead of encrypts :-))
`Quote from IBM Tivoli DS documentation
<
https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_71/rzahy/rzahypw...:
"After the server is configured, any new passwords (for new
users) or modified passwords (for existing users) are encrypted before
they are stored in the directory database. Subsequent LDAP searches will
return a tagged and encrypted value."
Implementation details
----------------------
When a password change is requested, ``sdap_pam_chpass_handler_send`` is
called.
This request first authenticates the user with current password and then in
``sdap_pam_chpass_handler_auth_done`` tries to change it with extended
operation
by calling ``sdap_exop_modify_passwd_send``. At this point we should check
the value of ``ldap_pwmodify_exop`` option and decide whether to continue
with
extended operation or use ``ldap_modify_ext`` instead.
Both operations use the connection that verified the current password not
connection that is used for ID lookups. Therefore the user that wants to
change
his/her password must be allowed to write to the userPassword attribute of
their object.
Information on how to change the password using simple LDAP modify operation
can be found `here
<
https://www.ibm.com/support/knowledgecenter/SSVJJU_6.3.0/com.ibm.IBMDS.do...
Configuration changes
---------------------
* New option: ``ldap_pwmodify_mode`` with possible values ``exop`` (default)
and ``ldap_modify``.
How To Test
-----------
* Set ``ldap_pwmodify_exop`` to false and try to change user's password.
You should change this paragraph to mention the ldap_modify, not
true/false