Bug 46354 – S4 Connector does not sync Samba/AD account lockout to LDAP ppolicy lockout

Bug 46354 - S4 Connector does not sync Samba/AD account lockout to LDAP ppolicy lockout


Summary:	S4 Connector does not sync Samba/AD account lockout to LDAP ppolicy lockout

Status:	RESOLVED WONTFIX

Product:	UCS
Classification:	Unclassified
Component:	S4 Connector
Version:	UCS 4.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:	Samba maintainers

URL:
Keywords:

Depends on:	46351 32014
Blocks:
	Show dependency tree / graph

Reported:	2018-02-20 20:46 CET by Arvid Requate
Modified:	2019-02-27 18:05 CET (History)
CC List:	5 users (show)

See Also:	35809 45128
What kind of report is it?:	Bug Report
What type of bug is this?:	5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?:	2: Will only affect a few installed domains
How will those affected feel about the bug?:	2: A Pain – users won’t like this once they notice it
User Pain:	0.114
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
s4connector_sync_to_ucs_account_lockout_to_ppolicy_lockout.patch (2.29 KB, patch) 2018-02-20 20:48 CET, Arvid Requate	Details \| Diff
s4connector_sync_to_ucs_account_lockout_to_univention_lib_account_lock.patch (2.40 KB, patch) 2018-02-20 20:54 CET, Arvid Requate	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2018-02-20 20:46:49 CET

The S4 Connector doesn't sync Samba/AD account lockout to LDAP ppolicy lockout.

The attached patch would make this happen automatically once the ppolicy lockout detection is implemented in the users/user module (Bug #46351)


+++ This bug was initially created as a clone of Bug #32014 +++

Comment 1 Arvid Requate

2018-02-20 20:48:39 CET

Created attachment 9403 [details]
s4connector_sync_to_ucs_account_lockout_to_ppolicy_lockout.patch

Comment 2 Arvid Requate

2018-02-20 20:54:08 CET

Created attachment 9404 [details]
s4connector_sync_to_ucs_account_lockout_to_univention_lib_account_lock.patch

This alternative patch would use univention.lib.account.lock, which would be more generic and leave the details up to udm users/user. The drawback is, that this converts the badPasswordTime from a resolution of 100 nanosecond to udm "lockedTime", which only offers a resolution of seconds. As a consequence the synchronization takes two to three turns instead of just one. Not so good.

Comment 3 Arvid Requate

2018-02-20 21:07:20 CET

To obtain a consistent lockout throughout Samba/AD and OpenLDAP, the ppolicy settings need to match the samba-tool domain passwordsettings. That's similar to UDM passsword policies.


FYI: Please also note that the http://www.zytrax.com/books/ldap/ch6/ppolicy.html overlay also allows per user lockout settings by adding a pwdPolicySubentry attribute to the user object. That's not active in UCS by default.

Comment 4 Stefan Gohmann

2019-01-03 07:17:36 CET

This issue has been filled against UCS 4.0. The maintenance with bug and security fixes for UCS 4.0 has ended on 31st of May 2016.

Customers still on UCS 4.0 are encouraged to update to UCS 4.3. Please contact
your partner or Univention for any questions.

If this issue still occurs in newer UCS versions, please use "Clone this bug" or simply reopen the issue. In this case please provide detailed information on how this issue is affecting you.