Bug 57220 – Replace shadowbind overlay with overlay to check for krb5 account/password expired

Bug 57220 - Replace shadowbind overlay with overlay to check for krb5 account/password expired


Summary:	Replace shadowbind overlay with overlay to check for krb5 account/password ex...

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	LDAP
Version:	UCS 5.2
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UCS maintainers
QA Contact:	UCS maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2024-04-11 14:33 CEST by Felix Botner
Modified:	2024-04-12 16:20 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Felix Botner

2024-04-11 14:33:21 CEST

Currently we use the shadowbind LDAP overlay to disable LDAP binds for accounts with password/account expired by shadow attributes (shadowExpire, shadowMax,shadowLastChange).

As of UCS 5.2 the shadow information will no longer be checked by PAM, we rely solely on pam_krb5 and its attributes and settings (krb5PasswordEnd, krb5ValidEnd).

But for keycloak we still need the shadowbind overlay. Keycloak authentications expects the LDAP bind to fail before checking expired passwords/accounts.

So we have to maintain the shadow attributes just to make the LDAP bind fail for keycloak.

To make all of this a bit more transparent we should replace the current shadowbind LDAP overlay with one that checks krb5PasswordEnd, krb5ValidEnd. If the password or account is expired, bind is rejected.

This would be the first step to start removing the shadow attributes from UCS.