From 1a192048a49fcdfa8bcfe79e2fa86153b339fac1 Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Tue, 13 Dec 2022 17:00:28 -0500
Subject: [PATCH 2/2] Issue 5565 - Change default password storage scheme

Descriptrion:  Becuase of replication we need to use a default storage scheme
that works on 389-ds-base-1.3.10

relates: https://github.com/389ds/389-ds-base/issues/5565

Reviewed by: spichugi & firstyear(thanks!!)
---
 .../tests/suites/healthcheck/health_security_test.py      | 8 ++++----
 dirsrvtests/tests/suites/password/pwp_test.py             | 2 +-
 ldap/servers/slapd/pw.c                                   | 3 ++-
 src/lib389/lib389/config.py                               | 2 +-
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/dirsrvtests/tests/suites/healthcheck/health_security_test.py b/dirsrvtests/tests/suites/healthcheck/health_security_test.py
index 519107365..d14b52c7a 100644
--- a/dirsrvtests/tests/suites/healthcheck/health_security_test.py
+++ b/dirsrvtests/tests/suites/healthcheck/health_security_test.py
@@ -1,5 +1,5 @@
 # --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2020 Red Hat, Inc.
+# Copyright (C) 2022 Red Hat, Inc.
 # All rights reserved.
 #
 # License: GPL (version 3 or any later version).
@@ -113,9 +113,9 @@ def test_healthcheck_insecure_pwd_hash_configured(topology_st):
         standalone.config.set('passwordStorageScheme', 'SSHA512')
         standalone.config.set('nsslapd-rootpwstoragescheme', 'SSHA512')
     else:
-        log.info('Set passwordStorageScheme and nsslapd-rootpwstoragescheme to PBKDF2-SHA512')
-        standalone.config.set('passwordStorageScheme', 'PBKDF2-SHA512')
-        standalone.config.set('nsslapd-rootpwstoragescheme', 'PBKDF2-SHA512')
+        log.info('Set passwordStorageScheme and nsslapd-rootpwstoragescheme to PBKDF2_SHA256')
+        standalone.config.set('passwordStorageScheme', 'PBKDF2_SHA256')
+        standalone.config.set('nsslapd-rootpwstoragescheme', 'PBKDF2_SHA256')
 
     run_healthcheck_and_flush_log(topology_st, standalone, json=False, searched_code=CMD_OUTPUT)
     run_healthcheck_and_flush_log(topology_st, standalone, json=True, searched_code=JSON_OUTPUT)
diff --git a/dirsrvtests/tests/suites/password/pwp_test.py b/dirsrvtests/tests/suites/password/pwp_test.py
index ce45bc364..190881222 100644
--- a/dirsrvtests/tests/suites/password/pwp_test.py
+++ b/dirsrvtests/tests/suites/password/pwp_test.py
@@ -27,7 +27,7 @@ else:
     if is_fips():
         DEFAULT_PASSWORD_STORAGE_SCHEME = 'SSHA512'
     else:
-        DEFAULT_PASSWORD_STORAGE_SCHEME = 'PBKDF2-SHA512'
+        DEFAULT_PASSWORD_STORAGE_SCHEME = 'PBKDF2_SHA256'
 
 
 def _create_user(topo, uid, cn, uidNumber, userpassword):
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 825498858..566ba87dd 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -280,7 +280,8 @@ pw_name2scheme(char *name)
         } else {
             /* if not, let's setup pbkdf2 */
 #ifdef RUST_ENABLE
-            char *pbkdf = "PBKDF2-SHA512";
+            /* until 1.3.10 supports Rust hashers we can't use PBKDF2-SHA512 by default */
+            char *pbkdf = "PBKDF2_SHA256";
 #else
             char *pbkdf = "PBKDF2_SHA256";
 #endif
diff --git a/src/lib389/lib389/config.py b/src/lib389/lib389/config.py
index c7abdf778..c178eb02f 100644
--- a/src/lib389/lib389/config.py
+++ b/src/lib389/lib389/config.py
@@ -209,7 +209,7 @@ class Config(DSLdapObject):
             yield report
 
     def _lint_passwordscheme(self):
-        allowed_schemes = ['SSHA512', 'PBKDF2-SHA512', 'GOST_YESCRYPT']
+        allowed_schemes = ['SSHA512', 'PBKDF2_SHA256', 'GOST_YESCRYPT']
         u_password_scheme = self.get_attr_val_utf8('passwordStorageScheme')
         u_root_scheme = self.get_attr_val_utf8('nsslapd-rootpwstoragescheme')
         if u_root_scheme not in allowed_schemes or u_password_scheme not in allowed_schemes:
-- 
2.38.1