Wednesday, March 16, 2022

[389-users] Re: passwordExpirationTime vs password admin

Well I can not reproduce your issue exactly, but I am on a newer version
of DS.  Although this code hasn't really changed in a long time.  Anyway
you have conflicting policies (sort of).  You have some things set in
the global policy and different settings in the subtree/local policies.

The global policy sets "pwdUpateTime", and the local policies only set
passwordExpirationtime.  So it's either one of the other depending where
the target user is that is modified.

You can try setting nsslapd-pwpolicy-inherit-global to "on". That is
supposed to merge the global and local policies, but I would prefer if
you added  passwordtrackupdatetime to all the local policies.  That's
one thing.  The other is that it looks like you are hitting a bug. 
Directory Manager is applying the local policy, while your other user is
only processing the global policy (which is wrong).  This is why the
behavior is different, but I can not explain why it's not consistent
between the two binding accounts (unless you modified the audit log
output you sent me).  Now you are on a older version of
389-ds-base-1.4.3, so if it's a bug its been fixed in newer versions.

So trying updating your polices as I mentioned above and see if it
helps.  Is there a newer version of 389-ds-base you can upgrade to (at
least to test this)?

Mark

On 3/16/22 3:20 PM, Mike Wohlgemuth wrote:
> Here is the dsconf output:
>
>
> # dsconf slapd-neuTestMain pwpolicy get
> Global Password Policy: cn=config
> ------------------------------------
> nsslapd-pwpolicy-local: on
> passwordstoragescheme: PBKDF2_SHA256
> passwordchange: on
> passwordmustchange: off
> passwordhistory: off
> passwordinhistory: 6
> passwordadmindn: cn=password_admins,ou=groups,dc=neu,dc=edu
> passwordtrackupdatetime: on
> passwordwarning: 86400
> passwordisglobalpolicy: off
> passwordexp: off
> passwordmaxage: 8640000
> passwordminage: 0
> passwordgracelimit: 0
> passwordsendexpiringtime: off
> passwordlockout: off
> passwordunlock: on
> passwordlockoutduration: 3600
> passwordmaxfailure: 3
> passwordresetfailurecount: 600
> passwordchecksyntax: off
> passwordminlength: 8
> passwordmindigits: 0
> passwordminalphas: 0
> passwordminuppers: 0
> passwordminlowers: 0
> passwordminspecials: 0
> passwordmin8bit: 0
> passwordmaxrepeats: 0
> passwordpalindrome: off
> passwordmaxsequence: 0
> passwordmaxseqsets: 0
> passwordmaxclasschars: 0
> passwordmincategories: 3
> passwordmintokenlength: 3
> passwordbadwords:
> passworduserattributes:
> passworddictcheck: off
> passworddictpath:
> nsslapd-allow-hashed-passwords: off
> nsslapd-pwpolicy-inherit-global: off
>
>
> # dsconf slapd-neuTestMain localpwp list
> ou=facultyandstaff,dc=neu,dc=edu (subtree policy)
> ou=people,dc=neu,dc=edu (subtree policy)
> ou=student,dc=neu,dc=edu (subtree policy)
>
>
> # dsconf slapd-neuTestMain localpwp get ou=facultyandstaff,dc=neu,dc=edu
> Local Subtree Policy Policy for "ou=facultyandstaff,dc=neu,dc=edu": cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3Dfacultyandstaff\2Cdc\3Dneu\2Cdc\3Dedu,cn=nsPwPolicyContainer,ou=facultyandstaff,dc=neu,dc=edu
> ------------------------------------
> passwordexp: on
> passwordmaxage: 31536000
>
>
> # dsconf slapd-neuTestMain localpwp get ou=people,dc=neu,dc=edu
> Local Subtree Policy Policy for "ou=people,dc=neu,dc=edu": cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3Dpeople\2Cdc\3Dneu\2Cdc\3Dedu,cn=nsPwPolicyContainer,ou=people,dc=neu,dc=edu
> ------------------------------------
> passwordexp: on
> passwordmaxage: 31536000
>
>
> [root@nb9545 ldap]# dsconf slapd-neuTestMain localpwp get ou=student,dc=neu,dc=edu
> Local Subtree Policy Policy for "ou=student,dc=neu,dc=edu": cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3Dstudent\2Cdc\3Dneu\2Cdc\3Dedu,cn=nsPwPolicyContainer,ou=student,dc=neu,dc=edu
> ------------------------------------
> passwordexp: on
> passwordmaxage: 31536000
> _______________________________________________
> 389-users mailing list -- 389-users@lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

--
Directory Server Development Team
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

No comments:

Post a Comment