freeipa

#7953 ipa-pwd-extop: do not remove MagicRegen mod, replace it
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

In 2012, ldbm backend in 389-ds started checking entry modification
after running betxnpreop plugins by comparing a number of modifications
before and after. If that number didn't change, it is considered that
plugins didn't modify the list.

ipa-pwd-extop actually removed and re-added modification to ipaNTHash if
it contained 'MagicRegen' value. This did not work since commit
https://pagure.io/389-ds-base/c/6c17ec56076d34540929acbcf2f3e65534060a43
but we were lucky nothing in FreeIPA code actually relied on that except
some code paths in ipasam Samba passdb driver. However, Samba didn't
reach the point where the code was triggered -- until now.

With support to run Samba as a domain member in IPA domain, that code
path is triggered for Kerberos service principals of domain members
(cifs/client.example.test, ...) and NT hash extraction from Kerberos
keys does not work.

Fix ipa-pwd-extop to follow recommendations in
https://pagure.io/389-ds-base/issue/387#comment-120145 and
https://pagure.io/389-ds-base/issue/50369#comment-570696

master:

  • 6a2c356da0c603f209f2310c013ef085e0c11eda ipa-run-tests: add support of globs for test targets and ignores
  • c8ef093e56e8eaa9c53abb31bed51ff30c9c64ef Azure Pipelines: simplify test job definitions
  • 5230e2a12ddbed0e27b107d7174d08e038f3bc1f Azure Pipelines: run fast linter in case of a pull request build
  • 53a0fa9130493d383d2542622ccdbdd483650bad LDAPCreate: allow callers to override objectclasses
  • ef67dece522335fd26fcdddc822beb4bcc8e6b17 ldap2.can_read: fix py3 compatibility
  • 6163cbc16658930f49794ebecd5a6ac14ba8cfd4 test_ipagetkeytab: allow testing LDAP connection beyond bind operation
  • 0f891c6a3fef7b75cb4b0a125e26e6e80b0bdcf3 test_ipagetkeytab: factor out DM password reader
  • b5fbbd1957873207afc2542a9d32246bccca0556 Keytab retrieval: allow requesting arcfour-hmac for SMB services
  • 46234f0cb91ad892b7420eb061e758e26c64e3c7 test_ipagetkeytab: test retrieval of explicit encryption types
  • a9bcf531a69b8a39ee2df86b4eb783023b33928e ipa-pwd-extop: do not remove MagicRegen mod, replace it

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.