389-ds-base

#49952 Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user
Closed by spichugi. Opened by mreynolds.
mreynolds/389-ds-base winsync-pwdlastset  into  master

Download 49952.patch

Bug Description:

If a user's password was reset by an "Admin" or directory manager, the
password policy requires a user must change their password after it's
been "reset", and the user then resets their password in DS, this
information was not sent to AD. Then if the user logged in AD after
resetting their password in DS they still get forced to change their
password again in AD.

Fix Description:

When sending a password update to AD, and AD is enforcing password must
be reset, check if the user's did reset thier password. If so, set the
correct "pwdLastSet" value to prevent AD from forcing that user to
change their password again.

But this only works going from DS to AD. The information needed to make
it work from AD -> DS is not available to passSync, and if it was available
it could not be correctly sent to DS anyway (not without a major redesign).

Side Note:

Also moved iand consolidated the function "fetch_attr" to util.c. It
was reused and redefined in many plugins. So I added the definition
to slapi-plugin.h and removed the duplicate definitions.

https://pagure.io/389-ds-base/issue/49950

Reviewed by: ?

If this is part of the api, this should be in entry.c, and probably "slapi_entry_fetch_attr" rather than this,

I'm happy with this, but I think that your cleanup of fetch_attr should be "slapi_entry_fetch_attr" and be a function in entry.c instead so that we can expose it cleanly and correctly.

The fix looks good to me. A minor question, why setting 'pwdLastSet=-1'.
If on AD side there is expiration time, I wonder if there is a risk '( - )' is greater than '', that may expire immediately the reset password

The fix looks good to me. A minor question, why setting 'pwdLastSet=-1'.
If on AD side there is expiration time, I wonder if there is a risk '( - )' is greater than '', that may expire immediately the reset password

My understanding is that pwdlastset is a flag, not a time stamp.

I agree with '0' it is a flag but looking a https://docs.microsoft.com/en-us/windows/desktop/ADSchema/a-pwdlastset, my understanding is that it can also be a timestamp.
I think the any value <>0 should prevent a reset but I am not sure we can compute a AD timestamp

I think the fix improve the situation and even if does not fully conform the semantic of pwdlastset it fixes a known issue.
I agree with the patch. ACK

rebased onto d9437be2e60fdbd6a5f1364f5887e1a3c89cda68

Pull-Request has been merged by mreynolds

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3011

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.