Issue #6511: Unexpected behavior of password policies when --failinterval is not set - freeipa

freeipa

#6511 Unexpected behavior of password policies when --failinterval is not set

Opened 7 years ago by pvomacka. Modified 5 years ago

Steps to reproduce:
1) Create new Password policy
2) Set --maxfail to lets say 10 (value does not matter)
3) Set --lockouttime to lets say 60 (value does not matter)
4) Try to kinit as user in group for which the policy was created
5) The account is locked after various number of failed attemps, not exactly after 10.

It works correctly when --failinterval is set to number != 0 .

pvoborni commented 7 years ago

Doc string should be enhanced.

dkupka: What is the expected behaviour here? From source code I can tell that when not set 0 is used but what should then happen? Reset the counter after 0 seconds or disable counter reseting at all?
- pvom: I don't know, I'm not sure how it should work or how it works. I have not found any information in: http://www.freeipa.org/page/V2/Group_Password_Policy or https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/user-pwdpolicy.html
- tkrizek: when failinterval=0, I get locket out after exactly the specified amount of maxfail. After the lockouttime expires, I have only a single attempt to enter password, then account gets locked again. I can't reproduce the behavior described in the ticket.
- pvom: I'll try to reproduce it again. Thank you for testing
- pvom: it behaves correctly, but what confused me is when I lock user (after specified number of failtures) then increase number of allowed failtures (it allows additional attemps to log in till it reaches the new limit) then I have one attemp after the lockouttime expires - as Tomas described. So, it is not a bug but it would be good to document it.

Metadata Update from @pvomacka:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5

7 years ago

Metadata Update from @mbasti:
- Issue close_status updated to: None
- Issue set to the milestone: FreeIPA 4.5.1 (was: FreeIPA 4.5)

7 years ago

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.7 (was: FreeIPA 4.5.1)

7 years ago

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

5 years ago

rcritten commented 5 years ago

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone

Metadata

Assignee

someone

Tags

None

Blocking

None

Depending on

None

Priority

low

Milestone

FreeIPA 4.7.1

None

affects_doc

None

source

None

knownissue

None

type

defect

blockedby

None

test_case

None

component

IPA

blocking

None

on_review

None

keywords

None

test_coverage

None

reviewer

None

external_tracker

None

rhbz

tester

None

changelog

None

design

None

freeipa

Source Code

#6511 Unexpected behavior of password policies when --failinterval is not set Opened 7 years ago by pvomacka. Modified 5 years ago

Close issue as:

Metadata

#6511 Unexpected behavior of password policies when --failinterval is not set

Opened 7 years ago by pvomacka. Modified 5 years ago