Bug 53691 – Fix {K5KEY} -Passwords ()

Bug 53691 - Fix {K5KEY} -Passwords ()


Summary:	Fix {K5KEY} -Passwords ()

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	Password changes
Version:	UCS 5.0
Hardware:	All All

Importance:	P5 enhancement (vote)
Target Milestone:	---
Assigned To:	UCS maintainers
QA Contact:	UCS maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2021-08-20 14:27 CEST by 90j4k89034mj95mj489
Modified:	2021-08-23 16:47 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description 90j4k89034mj95mj489 2021-08-20 14:27:40 CEST

I need to have a hashed user Password for my external App as I cannot use the NT-Password there (it gets synched)

The Password gets generated correctly when I set it using admin -> users (app)
but it won't when I use the selfservice.

here is an easy solution to fix the problem:
https://help.univention.com/t/password-self-service-macht-murks/9153/12

Comment 1 Florian Best

2021-08-20 14:39:24 CEST

Try using the `userPassword` attribute instead of the `krb5Key`.

Comment 2 90j4k89034mj95mj489 2021-08-23 09:40:31 CEST

I actually use the "userPassword" -Attribute but the value on the field is "K5Key" for every user which changes his password through self-service. only when an admin sets the passwords inside the user-apps the value is correct and usable by my external App.

Comment 3 Florian Best

2021-08-23 16:47:39 CEST

The self service doesn't directly insert `{K5KEY}` into the userPassword attribute. This is done by the AD-Connector and the S4-Connector. So there was a password set in Samba 4 or AD, which only transmits hashes to UCS.
We don't have any plaintext password, so we can't write any into the userPasword attribute.

The self-service detects if the UCS is configured as AD member (UCR variable ad/member) and the user originates from AD. Then it uses samba-tools to set the password in Samba.