From mihai.munteanu@thalesgroup.com Fri Oct 27 13:01:56 2017 From: mihai.munteanu@thalesgroup.com To: openldap-bugs@openldap.org Subject: Re: (ITS#8762) Unlocking an account doesn't remove pwdFailureTime Date: Fri, 27 Oct 2017 13:01:46 +0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5798222417795525492==" --===============5798222417795525492== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit --_000_73687a3a63cc4dd6950d893d7e7e73e9THSONEA01HUB06Ponegrp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable 1. See below the contents of our password policy: # Search scope: sub # Search filter: (objectClass=3D*) # Total entries: 1 # # Generated by LDAP Account Manager (http://www.ldap-account-manager.org) on October 27, 2017 10:48 am # Versio= n: 5.5 version: 1 # Entry 1: cn=3DpasswordDefault,ou=3Dpolicies,dc=3Dthales,dc=3Dcom dn: cn=3DpasswordDefault,ou=3Dpolicies,dc=3Dthales,dc=3Dcom cn: passwordDefault createtimestamp: 20171004124029Z creatorsname: dc=3DManager,dc=3Dthales,dc=3Dcom entrycsn: 20171004124029.795969Z#000000#000#000000 entrydn: cn=3DpasswordDefault,ou=3Dpolicies,dc=3Dthales,dc=3Dcom entryuuid: f3031268-3d4c-1037-9198-453c4b052276 hassubordinates: FALSE modifiersname: dc=3DManager,dc=3Dthales,dc=3Dcom modifytimestamp: 20171004124029Z objectclass: top objectclass: device objectclass: pwdPolicy objectclass: pwdPolicyChecker pwdallowuserchange: TRUE pwdattribute: userPassword pwdcheckmodule: check_password.so pwdcheckquality: 2 pwdexpirewarning: 0 pwdfailurecountinterval: 0 pwdgraceauthnlimit: 0 pwdinhistory: 4 pwdlockout: TRUE pwdlockoutduration: 0 pwdmaxage: 7776000 pwdmaxfailure: 3 pwdminage: 0 pwdminlength: 8 pwdmustchange: FALSE pwdsafemodify: FALSE structuralobjectclass: device subschemasubentry: cn=3DSubschema ----------------- 2. we are using the lamcms from www.ldap-account-manager.org. In the web interface there is a "Unlock account" bu= tton which we use. I suppose they are using the php ldap_modify() method in= order to remove the 'pwdAccountLockedTime' field. Of course, temporary mod= ifying their sources and trying to remove also the pwdFailureTime generates= the following error: "Was unable to remove attributes from DN: cn=3Dtest1,ou=3Dusers,dc=3Dthales= ,dc=3Dcom. LDAP error, server says: Constraint violation - pwdFailureTime: no user mod= ification allowed" We've contact also guys from ldap-account-manager.org but they said they ca= n't do anything on their side and suggested to contact you. Kind regards, Mihai --_000_73687a3a63cc4dd6950d893d7e7e73e9THSONEA01HUB06Ponegrp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

1. See below = the contents of our password policy:

= # Search scope: sub

# Search filter: = (objectClass=3D*)

# Total entries: 1<= o:p>

#

# Generated by LDAP Account Manager

(http://www.ldap-account-= manager.org) on October 27, 2017 10:48 am # Version: 5.5

=

versio= n: 1

# Entry 1: cn=3DpasswordDefault,ou=3Dpolicies,dc=3Dthales,dc= =3Dcom

dn: cn=3DpasswordDefault,ou=3D= policies,dc=3Dthales,dc=3Dcom

cn: pas= swordDefault

createtimestamp: 2017100= 4124029Z

creatorsname: dc=3DManager,d= c=3Dthales,dc=3Dcom

entrycsn: 2017100= 4124029.795969Z#000000#000#000000

ent= rydn: cn=3DpasswordDefault,ou=3Dpolicies,dc=3Dthales,dc=3Dcom

entryuuid: f3031268-3d4c-1037-9198-453c4b052276

hassubordinates: FALSE

modifiersname: dc=3DManager,dc=3Dthales,dc=3Dcom=

modifytimestamp: 20171004124029Z

objectclass: top

objectclass: device

objectc= lass: pwdPolicy

objectclass: pwdPolic= yChecker

pwdallowuserchange: TRUE

pwdattribute: userPassword

pwdcheckmodule: check_password.so

pwdcheckquality: 2

pwdexpirewarning: 0

pwdfailurecou= ntinterval: 0

pwdgraceauthnlimit: 0

pwdinhistory: 4

pwdlockout: TRUE

pwdl= ockoutduration: 0

pwdmaxage: 7776000<= o:p>

pwdmaxfailure: 3

pwdminage: 0

pwdmin= length: 8

pwdmustchange: FALSE

pwdsafemodify: FALSE

structuralobjectclass: device

subschemasubentry: cn=3DSubschema

-----------------

2. we are using the lamcms from www.ldap-account-manager.org. In t= he web interface there is a "Unlock account" button which we use.= I suppose they are using the php ldap_modify() method in order to remove t= he 'pwdAccountLockedTime' field. Of course, temporary modifying their sourc= es and trying to remove also the pwdFailureTime generates the following err= or:

"Was unable to remove attri= butes from DN: cn=3Dtest1,ou=3Dusers,dc=3Dthales,dc=3Dcom.

LDAP error, server says: Constraint violation - pwdFa= ilureTime: no user modification allowed"

We've contact also guys from ldap-account-manager.org but they sai= d they can't do anything on their side and suggested to contact you.

= Kind regards,

Mihai

= --_000_73687a3a63cc4dd6950d893d7e7e73e9THSONEA01HUB06Ponegrp_-- --===============5798222417795525492==--