Bug 38060 – k5pwd overlay doesn't work if account expires

Bug 38060 - k5pwd overlay doesn't work if account expires


Summary:	k5pwd overlay doesn't work if account expires

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	LDAP
Version:	UCS 4.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 4.0-1-errata
Assigned To:	Stefan Gohmann
QA Contact:	Felix Botner

URL:
Keywords:

Depends on:	31429
Blocks:
	Show dependency tree / graph

Reported:	2015-03-17 12:22 CET by Stefan Gohmann
Modified:	2015-03-25 16:38 CET (History)
CC List:	6 users (show)

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Stefan Gohmann

2015-03-17 12:22:17 CET

Needs to be fixed for UCS 4.0 as well.

+++ This bug was initially created as a clone of Bug #31429 +++

If the last password change occured by Keberos/Samba4/Windows (userPassword={K5KEY}), ldap-bind against slapd fails if the account has an expiry-Date:

----------------------------------------------------
root@dcm:~# univention-ldapsearch uid=accounttest2 userpassword -LLL|ldapsearch-wrapper|ldapsearch-decode64
dn: uid=accounttest2,cn=users,dc=s4sites,dc=local
userPassword: {K5KEY}

root@dcm:~# udm users/user modify --dn uid=accounttest2,cn=users,dc=s4sites,dc=local --set userexpiry=2014-05-31
Object modified: uid=accounttest2,cn=users,dc=s4sites,dc=local

root@dcm:~# ldapsearch -x -h dcm -p 7389 -D "uid=accounttest2,cn=users,dc=s4sites,dc=local" -w Herbert.123 uid=accounttest2 uid
ldap_bind: Invalid credentials (49)

root@dcm:~# udm users/user modify --dn uid=accounttest2,cn=users,dc=s4sites,dc=local --set userexpiry=
Object modified: uid=accounttest2,cn=users,dc=s4sites,dc=local

root@dcm:~# ldapsearch -x -h dcm -p 7389 -D "uid=accounttest2,cn=users,dc=s4sites,dc=local" -w Herbert.123 uid=accounttest2 uid -LLL
dn: uid=accounttest2,cn=users,dc=s4sites,dc=local
uid: accounttest2
----------------------------------------------------

Comment 1 Stefan Gohmann

2015-03-17 15:00:21 CET

YAML:  dev/branches/ucs-4.0/ucs-4.0-1/doc/errata/staging/2015-03-17-openldap.yaml

Fix: r14490 + r14491

Test case: 10_ldap/05K5KEY_userexpiry (r59098)

Comment 2 Felix Botner

2015-03-23 10:57:16 CET

-> univention-ldapsearch uid=test1 -LLL userPassword|ldapsearch-decode64 
dn: uid=test1,cn=users,dc=four,dc=test
userPassword: {K5KEY}

-> univention-ldapsearch -LLL -D uid=test1,cn=users,dc=four,dc=test -w Univention.99 uid=test1 dn
dn: uid=test1,cn=users,dc=four,dc=test

OK - password expired
     -> udm users/user modify --dn uid=test1,cn=users,dc=four,dc=test --set    
        userexpiry=2014-05-31
     -> univention-ldapsearch -D uid=test1,cn=users,dc=four,dc=test -w 
        Univention.99 uid=test1 dn
     ldap_bind: Invalid credentials (49)

OK - password no yet expired
     -> udm users/user modify --dn uid=test1,cn=users,dc=four,dc=test --set 
        userexpiry=2017-05-31
     -> univention-ldapsearch -LLL -D uid=test1,cn=users,dc=four,dc=test -w 
        Univention.99 uid=test1 dn
     dn: uid=test1,cn=users,dc=four,dc=test

OK - no password expiry
     -> udm users/user modify --dn uid=test1,cn=users,dc=four,dc=test --set 
        userexpiry=
     -> univention-ldapsearch -LLL -D uid=test1,cn=users,dc=four,dc=test -w 
        Univention.99 uid=test1 dn
     dn: uid=test1,cn=users,dc=four,dc=test

OK - 10_ldap/05K5KEY_userexpiry

OK - 2015-03-17-openldap.yaml

Comment 3 Janek Walkenhorst

2015-03-25 16:38:29 CET

<http://errata.univention.de/ucs/4.0/130.html>