Bug description: Deleting and adding password operation causes
the crash since once an entry is written to and retrieved from
DB, it does not have unhashed#user#password in the entry any
more. The delete userpassword internally invokes delete unhashed

user#password, which blindly expected unhashed#user#password

existed in the entry.

Fix description: Once the internal attribute value pair is
stored in an entry extension, the mod for the attribute is
changed to the "disabled" mode. Also, this patch adds the
stricter check for the NULL reference.

git patch file (master)
0002-Ticket-47391-deleting-and-adding-userpassword-fails-.patch

Nathan Kinder wrote:

ack. The fix makes sense to me.

Thanks to Nathan for his prompt review!

Bug description: Deleting and adding password operation causes
the crash since once an entry is written to and retrieved from
DB, it does not have unhashed#user#password in the entry any
more. The delete userpassword internally invokes delete unhashed
existed in the entry.

Fix description: Once the internal attribute value pair is
stored in an entry extension, the mod for the attribute is
changed to the "disabled" mode. Also, this patch adds the
stricter check for the NULL reference.

Reviewed by Nathan (Thank you!!)

Pushed to master: commit 4305deeaa41ea8703ebb9ea6529790dd609b3060

Pushed to 389-ds-base-1.3.1: commit ed09682086a2188a569e787fb696d3f6e77573cd

To Do: back port to 1.3.0 and 1.2.11, as well.

Bug description: ldapmodify with changetype "modify" is supposed
to skip checking unhashed password in acl_check_mods. "delete"
and "replace" were being skipped, but not "add".

Fix description: "add" also skips to check unhashed password.

git patch file (master)
0001-Ticket-47391-deleting-and-adding-userpassword-fails-.patch

Steps:
{{{
Add a user entry userA with userPassword.
Give ACI to userA to update its own password.
Restart the server to evict the entry from the entry cache.
ldapmodify ... -D "" -w ""
dn:
changetype: modify
delete: userpassword
-
add: userpassword userpassword: newpassword
}}}

Reviewed by Rich (Thank you!!)

Pushed to master: commit 5337dcfa67827ac46df68a2f817eade638eb352d

Pushed to 389-ds-base-1.3.1: commit d3300a999b01a8c898db4733551c7c5634a77d8d

Pushed to 389-ds-base-1.3.0: commit bf1f5323c4f529bd307f424c60e29c5bfa3ceaa7, commit ff13a9c7a0ff1ad5e5796f9b4afbe829cda19212

Pushed to 389-ds-base-1.2.11: commit 7d8bddd281294b6f2dcdc0ed431680e505ed5e1a, commit 9d9e9a6f132eb7bcbac3d3d6d39b27e38b6abb6b

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/728

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.