Looks like we aren't handling set correctly. It allows an empty modification to be performed:

[root@localhost cli]# ./dsconf localhost pwpolicy set
Successfully updated global password policy

Audit log:

time: 20180824152612
dn: cn=config
result: 0
changetype: modify
replace: modifiersname
modifiersname: cn=dm
-
replace: modifytimestamp
modifytimestamp: 20180824192612Z
-

We should handling that better and returning an error/usage

I think the local password policy "list" could be improved:

[root@localhost cli]# ./dsconf localhost localpwp adduser --pwdtrack=on "ou=people,dc=example,dc=com"
Successfully created user password policy
[root@localhost cli]# ./dsconf localhost localpwp list dc=example,dc=com
[root@localhost cli]# ./dsconf localhost localpwp list ou=people,dc=example,dc=com
ou=people,dc=example,dc=com (user policy)

I think using the DN of "dc=example,dc=com" should return all the policies, but it looks like its doing a BASE scope search, and not a subtree search.

The rest looks good, CLI seems to work fine (except for list), nice job!

Thanks!
The issues are fixed, please, review.

I found an issue, not yours, but mine from the original commit. This error talks about creating a user policy when I am just trying to list all policies on a DN that does not exist:

# ./dsconf localhost localpwp list ou=TYPO,dc=example,dc=com
Error: Can not create user password policy because the target dn does not exist

So this error should be cleaned up, and maybe check all the errors messages for more copy-paste errors. Thanks!

The rest looks good, ACK

Nice catch! Fixed.
I cleaned up the errors. I'll give some time for William to review it too. I'll merge tomorrow if nothing will come up.

Shouldn't this be a subclass of CosTemplates?

Hey, aren't pwpolicies subclasses of CosTemplates because they are cosTemplates?

Sorry for late review, I was unwell and travelling

Hey, aren't pwpolicies subclasses of CosTemplates because they are cosTemplates?

As I see the feature, we have one manager class which takes care of all PwPolicies (user, subtree and global). We use it for CLI (and WebUI) and we can use it for writing tests/set up the policy with lib389 API.

If I understood you correctly, the case you mentioned is about subtree policy only. I use cosTeamplate DSLdapObject but I do it in the PwPolicyManager method - create_subtree_policy.

I was referring to this guide (and existing Mark's code)
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/html-single/administration_guide/index#Configuring_the_Password_Policy-Configuring_SubtreeUser_Password_Policy_Using_the_Command_Line

@spichugi Okay, I'll need to re-read this to review properly. I'll trust you have done it for now, and we can always correct it later if needed.

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/2982

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.