1:33 p.m.
https://bugs.openldap.org/show_bug.cgi?id=9575
Issue ID: 9575
Summary: Object class olcGlobal should not allow
olcPasswordHash
Product: OpenLDAP
Version: 2.5.5
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: michael(a)stroeder.com
Target Milestone: ---
Object class olcGlobal should not allow olcPasswordHash because slapd will
crash during start if attribute is set.
Reported in this thread:
https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.or...
--
You are receiving this mail because:
You are on the CC list for the issue.
1:39 p.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
--- Comment #1 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
commit 2437abac38f99d314aa0886dcacefa6ee35505bf
Author: Howard Chu <hyc(a)openldap.org>
Date: Sun Sep 2 13:24:14 2007 +0000
ITS#5082 RE23 compatibility, allow olcPasswordHash in global entry
is why this is there.
--
You are receiving this mail because:
You are on the CC list for the issue.
1:47 p.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
--- Comment #2 from Michael Ströder <michael(a)stroeder.com> ---
On 6/7/21 10:39 PM, openldap-its(a)openldap.org wrote:
ITS#5082 RE23 compatibility, allow olcPasswordHash in global
entry
is why this is there.
So it's time to drop it, isn't it?
Ciao, Michael.
--
You are receiving this mail because:
You are on the CC list for the issue.
1:59 p.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
--- Comment #3 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
(In reply to Michael Ströder from comment #2)
On 6/7/21 10:39 PM, openldap-its(a)openldap.org wrote:
> ITS#5082 RE23 compatibility, allow olcPasswordHash in global entry
> is why this is there.
So it's time to drop it, isn't it?
No. If you actually read the full code associated with the commit, slapd is
supposed to correctly handle the value existing in the global location.
Clearly there's a bug there that needs to be fixed, but the 2.3 compatibility
should remain. We still have people show up with 2.0 systems...
--
You are receiving this mail because:
You are on the CC list for the issue.
3:18 p.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
--- Comment #4 from Howard Chu <hyc(a)openldap.org> ---
(In reply to Quanah Gibson-Mount from comment #3)
(In reply to Michael Ströder from comment #2)
> On 6/7/21 10:39 PM, openldap-its(a)openldap.org wrote:
> > ITS#5082 RE23 compatibility, allow olcPasswordHash in global entry
> > is why this is there.
>
> So it's time to drop it, isn't it?
No. If you actually read the full code associated with the commit, slapd is
supposed to correctly handle the value existing in the global location.
Clearly there's a bug there that needs to be fixed, but the 2.3
compatibility should remain. We still have people show up with 2.0
systems...
No bug. cn=config is read before cn=module,cn=config so you obviously can't
refer to a hash mechanism in cn=config that's dynamically loaded.
This ticket is invalid.
--
You are receiving this mail because:
You are on the CC list for the issue.
3:38 p.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
--- Comment #5 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
(In reply to Howard Chu from comment #4)
No bug. cn=config is read before cn=module,cn=config so you obviously
can't
refer to a hash mechanism in cn=config that's dynamically loaded.
This ticket is invalid.
The ticket is definitely not invalid. If what you say is the case, then the
attribute should not be allowed in global config, and
2437abac38f99d314aa0886dcacefa6ee35505bf likely should be reverted in its
entirety.
--
You are receiving this mail because:
You are on the CC list for the issue.
9:53 a.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|bugs(a)openldap.org |ondra(a)mistotebe.net
Target Milestone|--- |2.6.0
--- Comment #6 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
olcPasswordHash works in the global section for built in mechanisms such as
{SSHA}.
Man page needs to be updated to note this (vs must be in frontend for external
modules).
slaptest should be able to catch this and report it as an error if
misconfigured.
--
You are receiving this mail because:
You are on the CC list for the issue.
11 a.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |FIXED
--- Comment #7 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
Commits:
• f016d887
by Ondřej Kuzník at 2021-06-21T15:32:03+00:00
ITS#9575 Warn when specifying olcPasswordHash in the cn=config entry
--
You are receiving this mail because:
You are on the CC list for the issue.
11 a.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
--- Comment #8 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
note: man page already explicitly says to configure this in the frontend db.
--
You are receiving this mail because:
You are on the CC list for the issue.
3:09 p.m.
New subject: [Issue 9575] Object class olcGlobal should not allow olcPasswordHash
https://bugs.openldap.org/show_bug.cgi?id=9575
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |VERIFIED
--
You are receiving this mail because:
You are on the CC list for the issue.
523
days inactive
663
days old
9 comments
1 participants
participants (1)
-
openldap-its＠openldap.org