#1019 sssd does not set shadowLastChange
Closed: Fixed None Opened 12 years ago by sgallagh.

https://bugzilla.redhat.com/show_bug.cgi?id=739312

Description of problem:

The LDAP chpass module of sssd modifies passwords on the LDAP server using the openldap password modify exop. Which is fine. The problem is that the openldap team don't consider it the exop's job to update shadowLastChange, so the server never records the fact that the password has changed. sssd needs to update this attribute when it modifies the password.


Version-Release number of selected component (if applicable):

sssd-1.5.1-34.el6.x86_64


How reproducible:

Always.


Steps to Reproduce:
1. Set up LDAP authentication using nis and shadow schemas.
2. Set password to expire (i.e. set shadowLastChange to 0)
3. Configure sssd for ldap (chpass_provider = ldap)
4. Log in and change password when prompted:

WARNING: Your password has expired.
You must change your password now and login again!


Actual results:

This prompt appears on every login.


Expected results:

Should only be prompted once.


Additional info:

Fields changed

coverity: =>
description: https://bugzilla.redhat.com/show_bug.cgi?id=739312

{{{
Description of problem:

The LDAP chpass module of sssd modifies passwords on the LDAP server using the openldap password modify exop. Which is fine. The problem is that the openldap team don't consider it the exop's job to update shadowLastChange, so the server never records the fact that the password has changed. sssd needs to update this attribute when it modifies the password.

Version-Release number of selected component (if applicable):

sssd-1.5.1-34.el6.x86_64

How reproducible:

Always.

Steps to Reproduce:
1. Set up LDAP authentication using nis and shadow schemas.
2. Set password to expire (i.e. set shadowLastChange to 0)
3. Configure sssd for ldap (chpass_provider = ldap)
4. Log in and change password when prompted:

WARNING: Your password has expired.
You must change your password now and login again!

Actual results:

This prompt appears on every login.

Expected results:

Should only be prompted once.

Additional info:
}}}
=> https://bugzilla.redhat.com/show_bug.cgi?id=739312

{{{
Description of problem:

The LDAP chpass module of sssd modifies passwords on the LDAP server using the openldap password modify exop. Which is fine. The problem is that the openldap team don't consider it the exop's job to update shadowLastChange, so the server never records the fact that the password has changed. sssd needs to update this attribute when it modifies the password.

Version-Release number of selected component (if applicable):

sssd-1.5.1-34.el6.x86_64

How reproducible:

Always.

Steps to Reproduce:
1. Set up LDAP authentication using nis and shadow schemas.
2. Set password to expire (i.e. set shadowLastChange to 0)
3. Configure sssd for ldap (chpass_provider = ldap)
4. Log in and change password when prompted:

WARNING: Your password has expired.
You must change your password now and login again!

Actual results:

This prompt appears on every login.

Expected results:

Should only be prompted once.

Additional info:
}}}

milestone: NEEDS_TRIAGE => SSSD 1.8.0
patch: => 0
rhbz: =>
tests: => 0
testsupdated: => 0
upgrade: => 0

Fields changed

type: defect => enhancement

Fields changed

blockedby: =>
blocking: =>
milestone: SSSD 1.8.0 => SSSD 1.7.91 (1.8.0 beta 1)
priority: major => minor

Fields changed

owner: somebody => jzeleny

Fixed by c975031

feature_milestone: =>
resolution: => fixed
status: new => closed

Metadata Update from @sgallagh:
- Issue assigned to jzeleny
- Issue set to the milestone: SSSD 1.8 beta

7 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/2061

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata