root DN, aka "cn=directory manager", should not be restricted by password policy. During ADD operations the root DN is incorrectly restricted by password policy. Updating an existing entry, doing a MOD, works as expected.
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1145378
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1145379
attachment 0001-Ticket-47900-Adding-an-entry-with-an-invalid-passwor.patch
83a6ceb..50820f8 master -> master commit 50820f80c2da853c29962485b5e9806e68d5aece Author: Mark Reynolds mreynolds@redhat.com Date: Tue Sep 30 10:07:33 2014 -0400
4e34740..ab36560 389-ds-base-1.3.3 -> 389-ds-base-1.3.3 commit ab36560c1f43674e6376bd6e4d7fde9e3c62170c
8c955b1..99b24d4 389-ds-base-1.3.2 -> 389-ds-base-1.3.2 commit 99b24d4f4ce21be57ef4814f714690a724e863d2
0b5f0d6..7b7d092 389-ds-base-1.3.1 -> 389-ds-base-1.3.1 commit 7b7d0929f2129801edb55b8c480f0b8ea8e4a2dc
dd62c75..950390b 389-ds-base-1.2.11 -> 389-ds-base-1.2.11 commit 950390bb09512a033a25f40e4f61f7346321a19a
The previous patch causes startup issues if a password admin is set...
When we setup backends at server startup we perform add operations, this patch attempts to search backends , while setting up a password policy, before they are actually setup/initialized.
attachment 0001-Ticket-47900-Server-fails-to-start-if-password-admin.patch
To ssh://git.fedorahosted.org/git/389/ds.git afc8b06..4711de6 master -> master
commit 4711de687174d6e5dd7b2c04782b62dc1cb90a6e Author: Mark Reynolds mreynolds@redhat.com Date: Thu Oct 2 10:17:13 2014 -0400
5353f9f..1bf510c 389-ds-base-1.3.3 -> 389-ds-base-1.3.3 commit 1bf510c11c2041e09cb991af79ce44523040281e
6ca4422..f9eed02 389-ds-base-1.3.2 -> 389-ds-base-1.3.2 commit f9eed02496e41426bdd3ba054bff04b4bf9825d5
154abc9..46051b4 389-ds-base-1.3.1 -> 389-ds-base-1.3.1 commit 46051b42d3917ff0c899b8480b5374429441f89e
950390b..ed6f09b 389-ds-base-1.2.11 -> 389-ds-base-1.2.11 commit ed6f09b278431967f9e8f1ca0ccb7484dc07f189
this commit breaks 1.2.11, pwdpolicy is not in the pblock. ticket 147 was not backported
I think ticket
https://fedorahosted.org/389/ticket/458
should be also backported:
We use global_slapdFrontendConfig.pw_policy.pw_admin ldap/servers/slapd/libglobs.c
and this field has been introduced in ticket 458.
Replying to [comment:13 gparente]:
I think ticket https://fedorahosted.org/389/ticket/458 should be also backported: We use global_slapdFrontendConfig.pw_policy.pw_admin ldap/servers/slapd/libglobs.c and this field has been introduced in ticket 458.
Ticket 458 was backported to 1.2.11 seven months ago.
But Ludwig is right, ticket 147 was not backported, this is bad. So the fix for 458 has been broken for a long time. Not sure why this never showed up as a compilation error.
Hi Mark,
you are right. Ticket 458 is already backported adding the fields.
Applying the 147 diffs, I have made these new fields disappear again as before ticket 458.
This is an existing problem on all branches cased by the latest patch. I have a new fix that will be going out for review shortly...
Sorry the last patch was for the wrong version of 389. Reworking patch...
Fix backport issue 0001-Ticket-47900-Fix-backport-issue-to-1.2.11.patch
ed6f09b..8512405 389-ds-base-1.2.11 -> 389-ds-base-1.2.11
commit 851240569e1759589e1d40ad3caf3da5726e263b Author: Mark Reynolds mreynolds@redhat.com Date: Tue Oct 7 14:24:17 2014 -0400
Metadata Update from @gparente: - Issue assigned to mreynolds - Issue set to the milestone: 1.2.11.33
389-ds-base is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in 389-ds-base's github repository.
This issue has been cloned to Github and is available here: - https://github.com/389ds/389-ds-base/issues/1231
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.
Metadata Update from @spichugi: - Issue close_status updated to: wontfix (was: Fixed)