From 578d207cd66e97e9ff8211559c62114a961e35a8 Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Tue, 28 Mar 2017 14:21:47 -0400
Subject: [PATCH] Issue 49039 - password min age should be ignored if password
needs to be reset
Description: Do not check the password minimum age when changing a password
if the password "must" be reset.
https://pagure.io/389-ds-base/issue/49039
Reviewed by: firstyear(Thanks!)
---
dirsrvtests/tests/tickets/ticket49039_test.py | 79 +++++++++++++++++++++++++++
ldap/servers/slapd/modify.c | 4 +-
2 files changed, 81 insertions(+), 2 deletions(-)
create mode 100644 dirsrvtests/tests/tickets/ticket49039_test.py
diff --git a/dirsrvtests/tests/tickets/ticket49039_test.py b/dirsrvtests/tests/tickets/ticket49039_test.py
new file mode 100644
index 0000000..e6d4c03
--- /dev/null
+++ b/dirsrvtests/tests/tickets/ticket49039_test.py
@@ -0,0 +1,79 @@
+import time
+import ldap
+import logging
+import pytest
+from lib389 import Entry
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+from lib389.topologies import topology_st as topo
+
+DEBUGGING = os.getenv("DEBUGGING", default=False)
+if DEBUGGING:
+ logging.getLogger(__name__).setLevel(logging.DEBUG)
+else:
+ logging.getLogger(__name__).setLevel(logging.INFO)
+log = logging.getLogger(__name__)
+
+USER_DN = 'uid=user,dc=example,dc=com'
+
+
+def test_ticket49039(topo):
+ """Test "password must change" verses "password min age". Min age should not
+ block password update if the password was reset.
+ """
+
+ # Configure password policy
+ try:
+ topo.standalone.modify_s("cn=config", [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on'),
+ (ldap.MOD_REPLACE, 'passwordMustChange', 'on'),
+ (ldap.MOD_REPLACE, 'passwordExp', 'on'),
+ (ldap.MOD_REPLACE, 'passwordMaxAge', '86400000'),
+ (ldap.MOD_REPLACE, 'passwordMinAge', '8640000'),
+ (ldap.MOD_REPLACE, 'passwordChange', 'on')])
+ except ldap.LDAPError as e:
+ log.fatal('Failed to set password policy: ' + str(e))
+
+ # Add user, bind, and set password
+ try:
+ topo.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1',
+ 'userpassword': PASSWORD
+ })))
+ except ldap.LDAPError as e:
+ log.fatal('Failed to add user: error ' + e.message['desc'])
+ assert False
+
+ # Reset password as RootDN
+ try:
+ topo.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'userpassword', PASSWORD)])
+ except ldap.LDAPError as e:
+ log.fatal('Failed to bind: error ' + e.message['desc'])
+ assert False
+
+ time.sleep(1)
+
+ # Reset password as user
+ try:
+ topo.standalone.simple_bind_s(USER_DN, PASSWORD)
+ except ldap.LDAPError as e:
+ log.fatal('Failed to bind: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topo.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'userpassword', PASSWORD)])
+ except ldap.LDAPError as e:
+ log.fatal('Failed to change password: error ' + e.message['desc'])
+ assert False
+
+ log.info('Test Passed')
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
+
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 4bef90a..32defae 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -1326,8 +1326,8 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
/* check if password is within password minimum age;
error result is sent directly from check_pw_minage */
- if ((internal_op || !pb->pb_conn->c_needpw) &&
- check_pw_minage(pb, &sdn, mod->mod_bvalues) == 1)
+ if (!pb->pb_conn->c_needpw &&
+ check_pw_minage(pb, &sdn, mod->mod_bvalues) == 1)
{
if (operation_is_flag_set(operation,OP_FLAG_ACTION_LOG_ACCESS))
{
--
2.9.3