November 2018 - 389-commits - Fedora mailing-lists

[389-ds-base] branch 389-ds-base-1.3.9 updated: Ticket 50062 - Replace error by warning in the state machine defined in repl5_inc_run
by git repository hosting 30 Nov '18

30 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.9 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.9 by this push: new 181ff36 Ticket 50062 - Replace error by warning in the state machine defined in repl5_inc_run 181ff36 is described below commit 181ff36ec5bdafadf075c1cb1ebb217740273293 Author: Mark Reynolds <mreynolds(a)redhat.com> AuthorDate: Fri Nov 30 10:48:35 2018 -0500 Ticket 50062 - Replace error by warning in the state machine defined in repl5_inc_run Description: Replace error log severity message from ERR to WARNING https://pagure.io/389-ds-base/issue/50062 Reviewed by: mreynolds(one line commit rule) (cherry picked from commit bae33f97c05932c95225beb2dd2b6f76c1970bef) --- ldap/servers/plugins/replication/repl5_inc_protocol.c | 2 +- ldap/servers/plugins/replication/windows_inc_protocol.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ldap/servers/plugins/replication/repl5_inc_protocol.c b/ldap/servers/plugins/replication/repl5_inc_protocol.c index 5cd4941..2aefb79 100644 --- a/ldap/servers/plugins/replication/repl5_inc_protocol.c +++ b/ldap/servers/plugins/replication/repl5_inc_protocol.c @@ -717,7 +717,7 @@ repl5_inc_run(Private_Repl_Protocol *prp) } else if ((e1 = event_occurred(prp, EVENT_WINDOW_CLOSED)) || event_occurred(prp, EVENT_BACKOFF_EXPIRED)) { /* this events - should not occur - log a warning and go to sleep */ - slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, + slapi_log_err(SLAPI_LOG_WARNING, repl_plugin_name, "repl5_inc_run - %s: " "Event %s should not occur in state %s; going to sleep\n", agmt_get_long_name(prp->agmt), e1 ? event2name(EVENT_WINDOW_CLOSED) : event2name(EVENT_BACKOFF_EXPIRED), state2name(current_state)); diff --git a/ldap/servers/plugins/replication/windows_inc_protocol.c b/ldap/servers/plugins/replication/windows_inc_protocol.c index 871a768..853467e 100644 --- a/ldap/servers/plugins/replication/windows_inc_protocol.c +++ b/ldap/servers/plugins/replication/windows_inc_protocol.c @@ -364,7 +364,7 @@ windows_inc_run(Private_Repl_Protocol *prp) } else if ((e1 = event_occurred(prp, EVENT_WINDOW_CLOSED)) || event_occurred(prp, EVENT_BACKOFF_EXPIRED)) { /* this events - should not occur - log a warning and go to sleep */ - slapi_log_err(SLAPI_LOG_ERR, windows_repl_plugin_name, + slapi_log_err(SLAPI_LOG_WARNING, windows_repl_plugin_name, "windows_inc_run - %s: " "Event %s should not occur in state %s; going to sleep\n", agmt_get_long_name(prp->agmt), -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated: Ticket 50062 - Replace error by warning in the state machine defined in repl5_inc_run
by git repository hosting 30 Nov '18

30 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch master in repository 389-ds-base. The following commit(s) were added to refs/heads/master by this push: new bae33f9 Ticket 50062 - Replace error by warning in the state machine defined in repl5_inc_run bae33f9 is described below commit bae33f97c05932c95225beb2dd2b6f76c1970bef Author: Mark Reynolds <mreynolds(a)redhat.com> AuthorDate: Fri Nov 30 10:48:35 2018 -0500 Ticket 50062 - Replace error by warning in the state machine defined in repl5_inc_run Description: Replace error log severity message from ERR to WARNING https://pagure.io/389-ds-base/issue/50062 Reviewed by: mreynolds(one line commit rule) --- ldap/servers/plugins/replication/repl5_inc_protocol.c | 2 +- ldap/servers/plugins/replication/windows_inc_protocol.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ldap/servers/plugins/replication/repl5_inc_protocol.c b/ldap/servers/plugins/replication/repl5_inc_protocol.c index 5cd4941..2aefb79 100644 --- a/ldap/servers/plugins/replication/repl5_inc_protocol.c +++ b/ldap/servers/plugins/replication/repl5_inc_protocol.c @@ -717,7 +717,7 @@ repl5_inc_run(Private_Repl_Protocol *prp) } else if ((e1 = event_occurred(prp, EVENT_WINDOW_CLOSED)) || event_occurred(prp, EVENT_BACKOFF_EXPIRED)) { /* this events - should not occur - log a warning and go to sleep */ - slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, + slapi_log_err(SLAPI_LOG_WARNING, repl_plugin_name, "repl5_inc_run - %s: " "Event %s should not occur in state %s; going to sleep\n", agmt_get_long_name(prp->agmt), e1 ? event2name(EVENT_WINDOW_CLOSED) : event2name(EVENT_BACKOFF_EXPIRED), state2name(current_state)); diff --git a/ldap/servers/plugins/replication/windows_inc_protocol.c b/ldap/servers/plugins/replication/windows_inc_protocol.c index 871a768..853467e 100644 --- a/ldap/servers/plugins/replication/windows_inc_protocol.c +++ b/ldap/servers/plugins/replication/windows_inc_protocol.c @@ -364,7 +364,7 @@ windows_inc_run(Private_Repl_Protocol *prp) } else if ((e1 = event_occurred(prp, EVENT_WINDOW_CLOSED)) || event_occurred(prp, EVENT_BACKOFF_EXPIRED)) { /* this events - should not occur - log a warning and go to sleep */ - slapi_log_err(SLAPI_LOG_ERR, windows_repl_plugin_name, + slapi_log_err(SLAPI_LOG_WARNING, windows_repl_plugin_name, "windows_inc_run - %s: " "Event %s should not occur in state %s; going to sleep\n", agmt_get_long_name(prp->agmt), -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.9 updated: Ticket 50028 - Update ds-replcheck usage for password options
by git repository hosting 30 Nov '18

30 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.9 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.9 by this push: new d808e3d Ticket 50028 - Update ds-replcheck usage for password options d808e3d is described below commit d808e3d68718a26166132f8ce7f99a77f548897c Author: Mark Reynolds <mreynolds(a)redhat.com> AuthorDate: Fri Nov 30 10:21:04 2018 -0500 Ticket 50028 - Update ds-replcheck usage for password options Description: Update usage for password file, and ignore tombstones from the missing entry stats https://pagure.io/389-ds-base/issue/50028 Reviedwed by: spichugi(Thanks!) --- ldap/admin/src/scripts/ds-replcheck | 43 +++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 7 deletions(-) diff --git a/ldap/admin/src/scripts/ds-replcheck b/ldap/admin/src/scripts/ds-replcheck index 5c195f9..f482406 100755 --- a/ldap/admin/src/scripts/ds-replcheck +++ b/ldap/admin/src/scripts/ds-replcheck @@ -117,8 +117,15 @@ def convert_entries(entries): it must be skipped ''' continue - if ('nsds5replconflict' in new_entry.data and 'nsTombstone' not in new_entry.data['objectclass'] and - 'nstombstone' not in new_entry.data['objectclass']): + + # lowercase all the objectclass values (easier for tombstone checking) + oc_vals = new_entry.data['objectclass'] + new_oc_vals = [] + for val in oc_vals: + new_oc_vals.append(val.lower()) + new_entry.data['objectclass'] = new_oc_vals + + if ('nsds5replconflict' in new_entry.data and 'nstombstone' not in new_entry.data['objectclass']): # This is a conflict entry that is NOT a tombstone entry (should this be reconsidered?) conflict_entries.append(new_entry) if 'glue' in new_entry.data['objectclass']: @@ -638,9 +645,11 @@ def do_offline_report(opts, output_file=None): if mresult['tombstone']: mtombstones += 1 - # continue if rresult['tombstone']: rtombstones += 1 + if mresult['tombstone'] or rresult['tombstone']: + # skip over tombstones + continue if mresult['conflict'] is not None or rresult['conflict'] is not None: # If either entry is a conflict we still process it here @@ -690,7 +699,7 @@ def do_offline_report(opts, output_file=None): mresult = ldif_search(MLDIF, dn) if rresult['tombstone']: rtombstones += 1 - # continue + continue if rresult['conflict'] is not None: rconflicts.append(rresult['conflict']) @@ -769,9 +778,12 @@ def check_for_diffs(mentries, mglue, rentries, rglue, report, opts): rentries += report['m_missing'] for mentry in mentries: + if 'nstombstone' in mentry.data['objectclass']: + # Ignore tombstones + continue rentry = get_entry(rentries, mentry.dn) if rentry: - if 'nsTombstone' not in rentry.data['objectclass'] and 'nstombstone' not in rentry.data['objectclass']: + if 'nstombstone' not in rentry.data['objectclass'] and 'nstombstone' not in rentry.data['objectclass']: diff = cmp_entry(mentry, rentry, opts) if diff: diff_report.append(format_diff(diff)) @@ -788,6 +800,9 @@ def check_for_diffs(mentries, mglue, rentries, rglue, report, opts): for rentry in rentries: # We should not have any entries if we are sync + if 'nstombstone' in rentry.data['objectclass']: + # Ignore tombstones + continue mentry = get_entry(mglue, rentry.dn) if mentry is None: m_missing.append(rentry) @@ -1159,6 +1174,7 @@ def main(): parser.add_argument('-D', '--binddn', help='The Bind DN', dest='binddn', default=None) parser.add_argument('-w', '--bindpw', help='The Bind password', dest='bindpw', default=None) parser.add_argument('-W', '--prompt', help='Prompt for the bind password', action='store_true', dest='prompt', default=False) + parser.add_argument('-y', '--pass-file', help='A text file contained the clear text password for the bind dn', dest='pass_file', default=None) parser.add_argument('-m', '--master_url', help='The LDAP URL for the Master server (REQUIRED)', dest='murl', default=None) parser.add_argument('-r', '--replica_url', help='The LDAP URL for the Replica server (REQUIRED)', @@ -1292,8 +1308,21 @@ def main(): print("Can't open file: " + args.file) exit(1) - if args.prompt: - opts['bindpw'] = getpass.getpass('Enter password:') + # Get the password from a file or by prompting + if args.pass_file: + # Read password from file + try: + with open(args.pass_file, "r") as f: + opts['bindpw'] = f.readline().rstrip() + f.close() + except EnvironmentError as e: + print("Failed to open password file: " + str(e)) + sys.exit(1) + elif args.prompt or args.bindpw is None: + # prompt for password + opts['bindpw'] = getpass.getpass('Enter password: ') + + if opts['mldif'] is not None and opts['rldif'] is not None: print ("Performing offline report...") -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (3fe4b5b -> b844aab)
by git repository hosting 30 Nov '18

30 Nov '18

This is an automated email from the git hooks/post-receive script. spichugi pushed a change to branch master in repository 389-ds-base. from 3fe4b5b Ticket 50028 - Revise ds-replcheck usage add b844aab Issue 50041 - Set the React dataflow foundation and add basic plugin UI No new revisions were added by this update. Summary of changes: src/cockpit/389-console/.eslintrc.json | 1 + src/cockpit/389-console/src/banner.html | 1 - src/cockpit/389-console/src/css/ds.css | 1567 ++++++++++---------- src/cockpit/389-console/src/ds.js | 14 +- src/cockpit/389-console/src/index.es6 | 30 +- .../389-console/src/lib/customTableToolbar.jsx | 61 + src/cockpit/389-console/src/lib/notifications.jsx | 44 + .../389-console/src/lib/plugins/pluginModal.jsx | 220 +++ .../389-console/src/lib/plugins/pluginTable.jsx | 376 +++++ src/cockpit/389-console/src/lib/tools.jsx | 58 + src/cockpit/389-console/src/plugins.jsx | 187 ++- src/cockpit/389-console/src/plugins.scss | 3 - src/cockpit/389-console/src/servers.js | 107 +- src/lib389/lib389/cli_conf/plugin.py | 76 +- 14 files changed, 1888 insertions(+), 857 deletions(-) create mode 100644 src/cockpit/389-console/src/lib/customTableToolbar.jsx create mode 100644 src/cockpit/389-console/src/lib/notifications.jsx create mode 100644 src/cockpit/389-console/src/lib/plugins/pluginModal.jsx create mode 100644 src/cockpit/389-console/src/lib/plugins/pluginTable.jsx create mode 100644 src/cockpit/389-console/src/lib/tools.jsx delete mode 100644 src/cockpit/389-console/src/plugins.scss -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (b646e4d -> 3fe4b5b)
by git repository hosting 29 Nov '18

29 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a change to branch master in repository 389-ds-base. from b646e4d Pass argument into hashtable_new add 3fe4b5b Ticket 50028 - Revise ds-replcheck usage No new revisions were added by this update. Summary of changes: .../tests/suites/ds_tools/replcheck_test.py | 44 +- ldap/admin/src/scripts/ds-replcheck | 755 ++++++++++++++------- man/man1/ds-replcheck.1 | 196 ++++-- 3 files changed, 666 insertions(+), 329 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.7 updated: Pass argument into hashtable_new
by git repository hosting 28 Nov '18

28 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.7 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.7 by this push: new 1b193a1 Pass argument into hashtable_new 1b193a1 is described below commit 1b193a1e97aaf0ab36ba819111239a7f71ef157c Author: Stanislav Levin <slev(a)altlinux.org> AuthorDate: Wed Nov 28 12:49:07 2018 +0300 Pass argument into hashtable_new @8915d8d87 and @4471b7350 modified "usetxn" parameter in "hashtable_new" scope (was a global variable before). But the callers of this function don't pass argument into. Thus, "usetxn" acts as an uninitialized auto variable. Fixes: https://pagure.io/389-ds-base/issue/50057 --- ldap/servers/plugins/memberof/memberof.h | 2 +- ldap/servers/plugins/memberof/memberof_config.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ldap/servers/plugins/memberof/memberof.h b/ldap/servers/plugins/memberof/memberof.h index cf02845..f049d38 100644 --- a/ldap/servers/plugins/memberof/memberof.h +++ b/ldap/servers/plugins/memberof/memberof.h @@ -102,7 +102,7 @@ void *memberof_get_plugin_id(void); void memberof_release_config(void); PRUint64 get_plugin_started(void); void ancestor_hashtable_entry_free(memberof_cached_value *entry); -PLHashTable *hashtable_new(); +PLHashTable *hashtable_new(int usetxn); int memberof_use_txn(); #endif /* _MEMBEROF_H_ */ diff --git a/ldap/servers/plugins/memberof/memberof_config.c b/ldap/servers/plugins/memberof/memberof_config.c index 8a27f52..04d5924 100644 --- a/ldap/servers/plugins/memberof/memberof_config.c +++ b/ldap/servers/plugins/memberof/memberof_config.c @@ -698,8 +698,8 @@ memberof_copy_config(MemberOfConfig *dest, MemberOfConfig *src) /* Allocate our caches here since we only copy the config at the start of an op */ if (memberof_use_txn() == 1){ - dest->ancestors_cache = hashtable_new(); - dest->fixup_cache = hashtable_new(); + dest->ancestors_cache = hashtable_new(1); + dest->fixup_cache = hashtable_new(1); } /* Check if the copy is already up to date */ -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.8 updated: Pass argument into hashtable_new
by git repository hosting 28 Nov '18

28 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.8 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.8 by this push: new 87aed55 Pass argument into hashtable_new 87aed55 is described below commit 87aed55eeeb9979760ed0414f0711349fa48fd3f Author: Stanislav Levin <slev(a)altlinux.org> AuthorDate: Wed Nov 28 12:49:07 2018 +0300 Pass argument into hashtable_new @8915d8d87 and @4471b7350 modified "usetxn" parameter in "hashtable_new" scope (was a global variable before). But the callers of this function don't pass argument into. Thus, "usetxn" acts as an uninitialized auto variable. Fixes: https://pagure.io/389-ds-base/issue/50057 --- ldap/servers/plugins/memberof/memberof.h | 2 +- ldap/servers/plugins/memberof/memberof_config.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ldap/servers/plugins/memberof/memberof.h b/ldap/servers/plugins/memberof/memberof.h index cf02845..f049d38 100644 --- a/ldap/servers/plugins/memberof/memberof.h +++ b/ldap/servers/plugins/memberof/memberof.h @@ -102,7 +102,7 @@ void *memberof_get_plugin_id(void); void memberof_release_config(void); PRUint64 get_plugin_started(void); void ancestor_hashtable_entry_free(memberof_cached_value *entry); -PLHashTable *hashtable_new(); +PLHashTable *hashtable_new(int usetxn); int memberof_use_txn(); #endif /* _MEMBEROF_H_ */ diff --git a/ldap/servers/plugins/memberof/memberof_config.c b/ldap/servers/plugins/memberof/memberof_config.c index 8a27f52..04d5924 100644 --- a/ldap/servers/plugins/memberof/memberof_config.c +++ b/ldap/servers/plugins/memberof/memberof_config.c @@ -698,8 +698,8 @@ memberof_copy_config(MemberOfConfig *dest, MemberOfConfig *src) /* Allocate our caches here since we only copy the config at the start of an op */ if (memberof_use_txn() == 1){ - dest->ancestors_cache = hashtable_new(); - dest->fixup_cache = hashtable_new(); + dest->ancestors_cache = hashtable_new(1); + dest->fixup_cache = hashtable_new(1); } /* Check if the copy is already up to date */ -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated: Pass argument into hashtable_new
by git repository hosting 28 Nov '18

28 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch master in repository 389-ds-base. The following commit(s) were added to refs/heads/master by this push: new b646e4d Pass argument into hashtable_new b646e4d is described below commit b646e4dafe63ea7a4bb471b1fbb06a031c9499a2 Author: Stanislav Levin <slev(a)altlinux.org> AuthorDate: Wed Nov 28 12:49:07 2018 +0300 Pass argument into hashtable_new @8915d8d87 and @4471b7350 modified "usetxn" parameter in "hashtable_new" scope (was a global variable before). But the callers of this function don't pass argument into. Thus, "usetxn" acts as an uninitialized auto variable. Fixes: https://pagure.io/389-ds-base/issue/50057 --- ldap/servers/plugins/memberof/memberof.h | 2 +- ldap/servers/plugins/memberof/memberof_config.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ldap/servers/plugins/memberof/memberof.h b/ldap/servers/plugins/memberof/memberof.h index cf02845..f049d38 100644 --- a/ldap/servers/plugins/memberof/memberof.h +++ b/ldap/servers/plugins/memberof/memberof.h @@ -102,7 +102,7 @@ void *memberof_get_plugin_id(void); void memberof_release_config(void); PRUint64 get_plugin_started(void); void ancestor_hashtable_entry_free(memberof_cached_value *entry); -PLHashTable *hashtable_new(); +PLHashTable *hashtable_new(int usetxn); int memberof_use_txn(); #endif /* _MEMBEROF_H_ */ diff --git a/ldap/servers/plugins/memberof/memberof_config.c b/ldap/servers/plugins/memberof/memberof_config.c index f081391..89fd012 100644 --- a/ldap/servers/plugins/memberof/memberof_config.c +++ b/ldap/servers/plugins/memberof/memberof_config.c @@ -698,8 +698,8 @@ memberof_copy_config(MemberOfConfig *dest, MemberOfConfig *src) /* Allocate our caches here since we only copy the config at the start of an op */ if (memberof_use_txn() == 1){ - dest->ancestors_cache = hashtable_new(); - dest->fixup_cache = hashtable_new(); + dest->ancestors_cache = hashtable_new(1); + dest->fixup_cache = hashtable_new(1); } /* Check if the copy is already up to date */ -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.9 updated (ac500d3 -> 851fcf8)
by git repository hosting 28 Nov '18

28 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a change to branch 389-ds-base-1.3.9 in repository 389-ds-base. from ac500d3 Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user add 851fcf8 Pass argument into hashtable_new No new revisions were added by this update. Summary of changes: ldap/servers/plugins/memberof/memberof.h | 2 +- ldap/servers/plugins/memberof/memberof_config.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated: Ticket 50053 - improve testcase
by git repository hosting 28 Nov '18

28 Nov '18

This is an automated email from the git hooks/post-receive script. tbordaz pushed a commit to branch master in repository 389-ds-base. The following commit(s) were added to refs/heads/master by this push: new f2ff28e Ticket 50053 - improve testcase f2ff28e is described below commit f2ff28e027dabccc92b43e079f90f5f86c4d8332 Author: Thierry Bordaz <tbordaz(a)redhat.com> AuthorDate: Wed Nov 28 17:50:11 2018 +0100 Ticket 50053 - improve testcase --- dirsrvtests/tests/suites/plugins/cos_test.py | 75 ++++++++++++++++++---------- 1 file changed, 50 insertions(+), 25 deletions(-) diff --git a/dirsrvtests/tests/suites/plugins/cos_test.py b/dirsrvtests/tests/suites/plugins/cos_test.py index a0551b9..c624e8f 100644 --- a/dirsrvtests/tests/suites/plugins/cos_test.py +++ b/dirsrvtests/tests/suites/plugins/cos_test.py @@ -29,7 +29,8 @@ def add_user(server, uid, testbase, locality=None, tel=None, title=None): 'uid': uid, 'l': locality, 'title': title, - 'telephoneNumber': tel}))) + 'telephoneNumber': tel, + 'description': 'description real'}))) @pytest.mark.ds50053 def test_cos_operational_default(topo): @@ -123,7 +124,9 @@ def test_cos_operational_default(topo): 'cosAttribute': 'description override'}))) # title cos override - TITLE_VIRT = "title is %s" % VIRTUAL + TITLE_VIRT = [] + for i in range(2): + TITLE_VIRT.append("title is %s %d" % (VIRTUAL, i)) TITLE_COS_TEMPLATE = "cn=title_template,%s" % PEOPLE TITLE_COS_DEFINITION = "cn=title_definition,%s" % PEOPLE inst.add_s(Entry((TITLE_COS_TEMPLATE, { @@ -142,52 +145,74 @@ def test_cos_operational_default(topo): assert len(ents) == 1 ent = ents[0] - # Check telephonenumber (specifier default) + # Check telephonenumber (specifier default) with real value => real assert ent.hasAttr('telephonenumber') value = ent.getValue('telephonenumber') - log.info('Returned telephonenumber: %s' % value) + log.info('Returned telephonenumber (exp. real): %s' % value) log.info('Returned telephonenumber: %d' % value.find(REAL.encode())) assert value.find(REAL.encode()) != -1 - # Check 'locality' (specifier operational-default) + # Check 'locality' (specifier operational-default) with real value => real assert ent.hasAttr('l') value = ent.getValue('l') - log.info('Returned l: %s' % value) + log.info('Returned l (exp. real): %s ' % value) log.info('Returned l: %d' % value.find(REAL.encode())) assert value.find(REAL.encode()) != -1 - # Check 'seealso' (specifier operational) + # Check 'seealso' (specifier operational) without real value => virtual assert not ent.hasAttr('seealso') ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0", ["seealso"]) assert len(ents) == 1 ent = ents[0] value = ent.getValue('seealso') - log.info('Returned seealso: %s' % value) + log.info('Returned seealso (exp. virtual): %s' % value) log.info('Returned seealso: %d' % value.find(VIRTUAL.encode())) assert value.find(VIRTUAL.encode()) != -1 - # Check 'description' (specifier override) + # Check 'description' (specifier override) with real value => virtual assert not ent.hasAttr('description') ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0") assert len(ents) == 1 ent = ents[0] value = ent.getValue('description') - log.info('Returned description: %s' % value) + log.info('Returned description (exp. virtual): %s' % value) log.info('Returned description: %d' % value.find(VIRTUAL.encode())) assert value.find(VIRTUAL.encode()) != -1 - # Check 'title' (specifier merge-schemes) - # commented because it does not work need to open a new ticket -# ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0") -# assert len(ents) == 1 -# ent = ents[0] -# found_real = False -# found_virtual = False -# for value in ent.getValues('title'): -# log.info('Returned title: %s' % value) -# if value.find(VIRTUAL.encode()) != -1: -# found_virtual = True -# if value.find(REAL.encode()) != -1: -# found_real = True -# assert found_virtual -# assert found_real \ No newline at end of file + # Check 'title' (specifier merge-schemes) with real value => real value returned + ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0") + assert len(ents) == 1 + ent = ents[0] + found_real = False + found_virtual = False + for value in ent.getValues('title'): + log.info('Returned title (exp. real): %s' % value) + if value.find(VIRTUAL.encode()) != -1: + found_virtual = True + if value.find(REAL.encode()) != -1: + found_real = True + assert not found_virtual + assert found_real + + # Check 'title ((specifier merge-schemes) without real value => real value returned + ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0") + assert len(ents) == 1 + inst.modify_s(ents[0].dn,[(ldap.MOD_DELETE, 'title', None)]) + + inst.restart() + ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0") + assert len(ents) == 1 + ent = ents[0] + found_real = False + found_virtual = False + count = 0 + for value in ent.getValues('title'): + log.info('Returned title(exp. virt): %s' % value) + count = count + 1 + if value.find(VIRTUAL.encode()) != -1: + found_virtual = True + if value.find(REAL.encode()) != -1: + found_real = True + assert not found_real + assert found_virtual + assert count == 2 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

FW: Swift Payment Receipt
by Mancini＠fedoraproject.org 28 Nov '18

28 Nov '18

Good day, Please find the attached payment document from our bank. Kindly confirm when you receive payment in your bank account.. I am in charge of payment and purchases not. my colleague is out of office. Attached is your corresponding invoice which has been settled Un saludo/Best regards Tamara Escolar Technical Service Administrative Assistant e-mail: support(a)jasco-spain.com JASCO ANALITICA SPAIN, S.L. C/ Rafael Bergamín, 16B 28043 Madrid Telf: 91.234.24.54 Fax: 91.413.11.82 Web: www.jasco-spain.com

1 0

[389-ds-base] branch master updated (a990d04 -> 5d7b95c)
by git repository hosting 28 Nov '18

28 Nov '18

This is an automated email from the git hooks/post-receive script. tbordaz pushed a change to branch master in repository 389-ds-base. from a990d04 Issue 49974 - lib389 - List instances with initconfig_dir instead of sysconf_dir add 5d7b95c Ticket 50053 - Subtree password policy overrides a user-defined password policy No new revisions were added by this update. Summary of changes: dirsrvtests/tests/suites/plugins/cos_test.py | 193 +++++++++++++++++++++++++++ ldap/servers/plugins/cos/cos_cache.c | 2 +- 2 files changed, 194 insertions(+), 1 deletion(-) create mode 100644 dirsrvtests/tests/suites/plugins/cos_test.py -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (5acc4e4 -> a990d04)
by git repository hosting 27 Nov '18

27 Nov '18

This is an automated email from the git hooks/post-receive script. spichugi pushed a change to branch master in repository 389-ds-base. from 5acc4e4 Issue 49984 - Add an empty domain creation to the dscreate add a990d04 Issue 49974 - lib389 - List instances with initconfig_dir instead of sysconf_dir No new revisions were added by this update. Summary of changes: src/lib389/lib389/instance/setup.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (d9437be -> 5acc4e4)
by git repository hosting 27 Nov '18

27 Nov '18

This is an automated email from the git hooks/post-receive script. spichugi pushed a change to branch master in repository 389-ds-base. from d9437be Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user add 5acc4e4 Issue 49984 - Add an empty domain creation to the dscreate No new revisions were added by this update. Summary of changes: .../lib389/configurations/config_001003006.py | 17 +++---------- .../lib389/configurations/config_001004000.py | 28 +++++++--------------- src/lib389/lib389/configurations/sample.py | 23 ++++++++++++++++++ src/lib389/lib389/instance/setup.py | 12 +++++++++- 4 files changed, 45 insertions(+), 35 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.7 updated: Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user
by git repository hosting 27 Nov '18

27 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.7 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.7 by this push: new 7e83f2a Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user 7e83f2a is described below commit 7e83f2afca7e1b652c46aaf5a43cc027705b1a3f Author: Mark Reynolds <mreynolds(a)redhat.com> AuthorDate: Fri Sep 14 11:24:35 2018 -0400 Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user Bug Description: If a user's password was reset by an "Admin" or directory manager, the password policy requires a user must change their password after it's been "reset", and the user then resets their password in DS, this information was not sent to AD. Then if the user logged in AD after resetting their password in DS they still get forced to change their password again in AD. Fix Description: When sending a password update to AD, and AD is enforcing password must be reset, check if the user's did reset thier password. If so, set the correct "pwdLastSet" value to prevent AD from forcing that user to change their password again. But this only works going from DS to AD. The information needed to make it work from AD -> DS is not available to passSync, and if it was available it could not be correctly sent to DS anyway (not without a major redesign). Side Note: Also moved iand consolidated the function "fetch_attr" to util.c. It was reused and redefined in many plugins. So I added the definition to slapi-plugin.h and removed the duplicate definitions. https://pagure.io/389-ds-base/issue/49950 Reviewed by: tbordaz(Thanks!) (cherry picked from commit d9437be2e60fdbd6a5f1364f5887e1a3c89cda68) (cherry picked from commit ac500d378aa22d5e818b110074ac9cd3e421e38d) --- ldap/servers/plugins/automember/automember.c | 20 ----- ldap/servers/plugins/linkedattrs/fixup_task.c | 20 ----- ldap/servers/plugins/memberof/memberof.c | 17 ---- .../plugins/posix-winsync/posix-group-task.c | 18 +---- .../plugins/replication/repl5_replica_config.c | 13 ---- .../plugins/replication/windows_protocol_util.c | 90 +++++++++++++++++----- ldap/servers/plugins/schema_reload/schema_reload.c | 17 ---- ldap/servers/plugins/syntaxes/validate_task.c | 20 ----- ldap/servers/slapd/slapi-plugin.h | 2 + ldap/servers/slapd/task.c | 17 ---- ldap/servers/slapd/test-plugins/sampletask.c | 16 ---- ldap/servers/slapd/util.c | 17 ++++ 12 files changed, 89 insertions(+), 178 deletions(-) diff --git a/ldap/servers/plugins/automember/automember.c b/ldap/servers/plugins/automember/automember.c index c91aa4e..d982d49 100644 --- a/ldap/servers/plugins/automember/automember.c +++ b/ldap/servers/plugins/automember/automember.c @@ -74,7 +74,6 @@ static void automember_free_regex_rule(struct automemberRegexRule *rule); static int automember_parse_grouping_attr(char *value, char **grouping_attr, char **grouping_value); static int automember_update_membership(struct configEntry *config, Slapi_Entry *e, PRFileDesc *ldif_fd); static int automember_add_member_value(Slapi_Entry *member_e, const char *group_dn, char *grouping_attr, char *grouping_value, PRFileDesc *ldif_fd); -const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); /* * task functions @@ -1927,25 +1926,6 @@ typedef struct _task_data int scope; } task_data; -/* - * extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Value *val = NULL; - Slapi_Attr *attr; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - static void automember_task_destructor(Slapi_Task *task) { diff --git a/ldap/servers/plugins/linkedattrs/fixup_task.c b/ldap/servers/plugins/linkedattrs/fixup_task.c index 900ee11..4929714 100644 --- a/ldap/servers/plugins/linkedattrs/fixup_task.c +++ b/ldap/servers/plugins/linkedattrs/fixup_task.c @@ -22,7 +22,6 @@ static void linked_attrs_fixup_task_thread(void *arg); static void linked_attrs_fixup_links(struct configEntry *config); static int linked_attrs_remove_backlinks_callback(Slapi_Entry *e, void *callback_data); static int linked_attrs_add_backlinks_callback(Slapi_Entry *e, void *callback_data); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); /* * Function Implementations @@ -459,22 +458,3 @@ done: return rc; } - -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} diff --git a/ldap/servers/plugins/memberof/memberof.c b/ldap/servers/plugins/memberof/memberof.c index 87313ff..26236dc 100644 --- a/ldap/servers/plugins/memberof/memberof.c +++ b/ldap/servers/plugins/memberof/memberof.c @@ -142,7 +142,6 @@ static int memberof_replace_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *con static int memberof_modop_one_replace_r(Slapi_PBlock *pb, MemberOfConfig *config, int mod_op, Slapi_DN *group_sdn, Slapi_DN *op_this_sdn, Slapi_DN *replace_with_sdn, Slapi_DN *op_to_sdn, memberofstringll *stack); static int memberof_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static void memberof_task_destructor(Slapi_Task *task); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static void memberof_fixup_task_thread(void *arg); static int memberof_fix_memberof(MemberOfConfig *config, Slapi_Task *task, task_data *td); static int memberof_fix_memberof_callback(Slapi_Entry *e, void *callback_data); @@ -2871,22 +2870,6 @@ done: "memberof_fixup_task_thread - refcount decremented.\n"); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - int memberof_task_add(Slapi_PBlock *pb, Slapi_Entry *e, diff --git a/ldap/servers/plugins/posix-winsync/posix-group-task.c b/ldap/servers/plugins/posix-winsync/posix-group-task.c index b4c5075..d8b6add 100644 --- a/ldap/servers/plugins/posix-winsync/posix-group-task.c +++ b/ldap/servers/plugins/posix-winsync/posix-group-task.c @@ -42,22 +42,6 @@ posix_group_fixup_task_thread(void *arg); static int posix_group_fix_memberuid_callback(Slapi_Entry *e, void *callback_data); -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - /* e configEntry */ int posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)), @@ -82,7 +66,7 @@ posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)), /* get arg(s) */ /* default: set replication basedn */ - if ((dn = fetch_attr(e, "basedn", slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) { + if ((dn = fetch_attr(e, "basedn", (char *)slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) { *returncode = LDAP_OBJECT_CLASS_VIOLATION; rv = SLAPI_DSE_CALLBACK_ERROR; goto out; diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c index ea430d9..84e0263 100644 --- a/ldap/servers/plugins/replication/repl5_replica_config.c +++ b/ldap/servers/plugins/replication/repl5_replica_config.c @@ -1353,19 +1353,6 @@ replica_execute_cleanruv_task(Object *r, ReplicaId rid, char *returntext __attri return LDAP_SUCCESS; } -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - static int replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)), Slapi_Entry *e, diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c index f350b6d..f6898d0 100644 --- a/ldap/servers/plugins/replication/windows_protocol_util.c +++ b/ldap/servers/plugins/replication/windows_protocol_util.c @@ -720,39 +720,79 @@ send_password_modify(Slapi_DN *sdn, } else { Slapi_Attr *attr = NULL; int force_reset_pw = 0; + int pwd_already_reset = 0; + int ds_must_change = config_get_pw_must_change(); + /* - * If AD entry has password must change flag is set, - * we keep the flag (pwdLastSet == 0). - * msdn.microsoft.com: Windows Dev Centor - Desktop - * To force a user to change their password at next logon, - * set the pwdLastSet attribute to zero (0). - */ + * If AD entry has password must change flag is set, + * we keep the flag (pwdLastSet == 0). + * msdn.microsoft.com: Windows Dev Centor - Desktop + * To force a user to change their password at next logon, + * set the pwdLastSet attribute to zero (0). + */ if (remote_entry && (0 == slapi_entry_attr_find(remote_entry, "pwdLastSet", &attr)) && - attr) { + attr) + { Slapi_Value *v = NULL; int i = 0; + for (i = slapi_attr_first_value(attr, &v); v && (i != -1); - i = slapi_attr_next_value(attr, i, &v)) { + i = slapi_attr_next_value(attr, i, &v)) + { const char *s = slapi_value_get_string(v); if (NULL == s) { continue; } if (0 == strcmp(s, "0")) { - slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, - "%s: AD entry %s set \"user must change password at next logon\". ", - agmt_get_long_name(prp->agmt), slapi_entry_get_dn(remote_entry)); force_reset_pw = 1; + if (ds_must_change) { + /* + * DS already enforces "password must be changed after reset". + * Do an internal search and check the passwordExpirationtime + * to see if is it actually needs to be reset. If it doesn't, + * then set pwdLastSet to -1 + */ + char *expiration_val; + int rc = 0; + Slapi_DN *local_sdn = NULL; + + rc = map_entry_dn_inbound(remote_entry, &local_sdn, prp->agmt); + if ((0 == rc) && local_sdn) { + Slapi_Entry *local_entry = NULL; + /* Get the local entry if it exists */ + rc = windows_get_local_entry(local_sdn, &local_entry); + if ((0 == rc) && local_entry) { + expiration_val = (char *)fetch_attr(local_entry, "passwordExpirationtime", NULL); + if (expiration_val && parse_genTime(expiration_val) != NO_TIME){ + /* The user did reset their password */ + slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, + "send_password_modify - entry (%s) password was reset by user send that info to AD\n", + slapi_sdn_get_dn(local_sdn)); + pwd_already_reset = 1; + force_reset_pw = 0; + } + slapi_entry_free(local_entry); + } + } + slapi_sdn_free(&local_sdn); + } else { + slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, + "%s: AD entry %s set \"user must change password at next logon\n", + agmt_get_long_name(prp->agmt), slapi_entry_get_dn(remote_entry));; + } } } } - /* We will attempt to bind to AD with the new password first. We do - * this to avoid playing a password change that originated from AD - * back to AD. If we just played the password change back, then - * both sides would be in sync, but AD would contain the new password - * twice in it's password history, which undermines the password - * history policies in AD. */ + /* + * We will attempt to bind to AD with the new password first. We do + * this to avoid playing a password change that originated from AD + * back to AD. If we just played the password change back, then + * both sides would be in sync, but AD would contain the new password + * twice in it's password history, which undermines the password + * history policies in AD. + */ if (windows_check_user_password(prp->conn, sdn, password)) { char *quoted_password = NULL; /* AD wants the password in quotes ! */ @@ -792,9 +832,18 @@ send_password_modify(Slapi_DN *sdn, pw_mod.mod_bvalues = bvals; pw_mods[0] = &pw_mod; - if (force_reset_pw) { - reset_bv.bv_len = 1; - reset_bv.bv_val = "0"; + + if (force_reset_pw || pwd_already_reset) { + if (force_reset_pw) { + reset_bv.bv_val = "0"; + reset_bv.bv_len = 1; + } else if (pwd_already_reset) { + /* Password was reset by the user, there is no + * need to make the user change their password + * again in AD so set pwdLastSet to -1 */ + reset_bv.bv_val = "-1"; + reset_bv.bv_len = 2; + } reset_bvals[0] = &reset_bv; reset_bvals[1] = NULL; reset_pw_mod.mod_type = "pwdLastSet"; @@ -807,7 +856,6 @@ send_password_modify(Slapi_DN *sdn, } pw_return = windows_conn_send_modify(prp->conn, slapi_sdn_get_dn(sdn), pw_mods, NULL, NULL); - slapi_ch_free((void **)&unicode_password); } PR_smprintf_free(quoted_password); diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c index ee3b00c..c2399e5 100644 --- a/ldap/servers/plugins/schema_reload/schema_reload.c +++ b/ldap/servers/plugins/schema_reload/schema_reload.c @@ -187,23 +187,6 @@ schemareload_thread(void *arg) "schemareload_thread <-- refcount decremented.\n"); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - static void schemareload_destructor(Slapi_Task *task) { diff --git a/ldap/servers/plugins/syntaxes/validate_task.c b/ldap/servers/plugins/syntaxes/validate_task.c index 2c625ba..afec9ef 100644 --- a/ldap/servers/plugins/syntaxes/validate_task.c +++ b/ldap/servers/plugins/syntaxes/validate_task.c @@ -43,7 +43,6 @@ static int syntax_validate_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entr static void syntax_validate_task_destructor(Slapi_Task *task); static void syntax_validate_task_thread(void *arg); static int syntax_validate_task_callback(Slapi_Entry *e, void *callback_data); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static void syntax_validate_set_plugin_id(void *plugin_id); static void *syntax_validate_get_plugin_id(void); @@ -258,25 +257,6 @@ bail: return rc; } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - /* * Plug-in identity management helper functions */ diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index bb6afab..7931ff6 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -8294,6 +8294,8 @@ int32_t slapi_atomic_decr_32(int32_t *ptr, int memorder); */ uint64_t slapi_atomic_decr_64(uint64_t *ptr, int memorder); +/* helper function */ +const char * fetch_attr(Slapi_Entry *e, const char *attrname, char *default_val); #ifdef __cplusplus } diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c index 3f9d5d9..698ee19 100644 --- a/ldap/servers/slapd/task.c +++ b/ldap/servers/slapd/task.c @@ -80,7 +80,6 @@ static void destroy_task(time_t when, void *arg); static int task_modify(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static int task_deny(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static void task_generic_destructor(Slapi_Task *task); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static Slapi_Entry *get_internal_entry(Slapi_PBlock *pb, char *dn); static void modify_internal_entry(char *dn, LDAPMod **mods); static void fixup_tombstone_task_destructor(Slapi_Task *task); @@ -684,22 +683,6 @@ destroy_task(time_t when, void *arg) slapi_ch_free((void **)&task); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - /* supply the pblock, destroy it when you're done */ static Slapi_Entry * get_internal_entry(Slapi_PBlock *pb, char *dn) diff --git a/ldap/servers/slapd/test-plugins/sampletask.c b/ldap/servers/slapd/test-plugins/sampletask.c index d04f21b..22d43dd 100644 --- a/ldap/servers/slapd/test-plugins/sampletask.c +++ b/ldap/servers/slapd/test-plugins/sampletask.c @@ -116,22 +116,6 @@ task_sampletask_thread(void *arg) slapi_task_finish(task, rv); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - static void task_sampletask_destructor(Slapi_Task *task) { diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c index cb46efb..8563c5d 100644 --- a/ldap/servers/slapd/util.c +++ b/ldap/servers/slapd/util.c @@ -1579,3 +1579,20 @@ slapi_create_errormsg( va_end(ap); } } + +/* + * Extract a single value from an entry (as a string) -- if it's not in the + * entry, the default will be returned (which can be NULL). You do not need + * to free the returned string value. + */ +const char * +fetch_attr(Slapi_Entry *e, const char *attrname, char *default_val) +{ + Slapi_Attr *attr; + Slapi_Value *val = NULL; + + if (slapi_entry_attr_find(e, attrname, &attr) != 0) + return default_val; + slapi_attr_first_value(attr, &val); + return slapi_value_get_string(val); +} -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.8 updated: Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user
by git repository hosting 27 Nov '18

27 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.8 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.8 by this push: new f13039b Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user f13039b is described below commit f13039ba76070ad30fdcdaf1b104196f2060a9b7 Author: Mark Reynolds <mreynolds(a)redhat.com> AuthorDate: Fri Sep 14 11:24:35 2018 -0400 Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user Bug Description: If a user's password was reset by an "Admin" or directory manager, the password policy requires a user must change their password after it's been "reset", and the user then resets their password in DS, this information was not sent to AD. Then if the user logged in AD after resetting their password in DS they still get forced to change their password again in AD. Fix Description: When sending a password update to AD, and AD is enforcing password must be reset, check if the user's did reset thier password. If so, set the correct "pwdLastSet" value to prevent AD from forcing that user to change their password again. But this only works going from DS to AD. The information needed to make it work from AD -> DS is not available to passSync, and if it was available it could not be correctly sent to DS anyway (not without a major redesign). Side Note: Also moved iand consolidated the function "fetch_attr" to util.c. It was reused and redefined in many plugins. So I added the definition to slapi-plugin.h and removed the duplicate definitions. https://pagure.io/389-ds-base/issue/49950 Reviewed by: tbordaz(Thanks!) (cherry picked from commit d9437be2e60fdbd6a5f1364f5887e1a3c89cda68) (cherry picked from commit ac500d378aa22d5e818b110074ac9cd3e421e38d) --- ldap/servers/plugins/automember/automember.c | 20 ----- ldap/servers/plugins/linkedattrs/fixup_task.c | 20 ----- ldap/servers/plugins/memberof/memberof.c | 17 ---- .../plugins/posix-winsync/posix-group-task.c | 18 +---- .../plugins/replication/repl5_replica_config.c | 13 ---- .../plugins/replication/windows_protocol_util.c | 90 +++++++++++++++++----- ldap/servers/plugins/schema_reload/schema_reload.c | 17 ---- ldap/servers/plugins/syntaxes/validate_task.c | 20 ----- ldap/servers/slapd/slapi-plugin.h | 2 + ldap/servers/slapd/task.c | 17 ---- ldap/servers/slapd/test-plugins/sampletask.c | 16 ---- ldap/servers/slapd/util.c | 17 ++++ 12 files changed, 89 insertions(+), 178 deletions(-) diff --git a/ldap/servers/plugins/automember/automember.c b/ldap/servers/plugins/automember/automember.c index c91aa4e..d982d49 100644 --- a/ldap/servers/plugins/automember/automember.c +++ b/ldap/servers/plugins/automember/automember.c @@ -74,7 +74,6 @@ static void automember_free_regex_rule(struct automemberRegexRule *rule); static int automember_parse_grouping_attr(char *value, char **grouping_attr, char **grouping_value); static int automember_update_membership(struct configEntry *config, Slapi_Entry *e, PRFileDesc *ldif_fd); static int automember_add_member_value(Slapi_Entry *member_e, const char *group_dn, char *grouping_attr, char *grouping_value, PRFileDesc *ldif_fd); -const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); /* * task functions @@ -1927,25 +1926,6 @@ typedef struct _task_data int scope; } task_data; -/* - * extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Value *val = NULL; - Slapi_Attr *attr; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - static void automember_task_destructor(Slapi_Task *task) { diff --git a/ldap/servers/plugins/linkedattrs/fixup_task.c b/ldap/servers/plugins/linkedattrs/fixup_task.c index 900ee11..4929714 100644 --- a/ldap/servers/plugins/linkedattrs/fixup_task.c +++ b/ldap/servers/plugins/linkedattrs/fixup_task.c @@ -22,7 +22,6 @@ static void linked_attrs_fixup_task_thread(void *arg); static void linked_attrs_fixup_links(struct configEntry *config); static int linked_attrs_remove_backlinks_callback(Slapi_Entry *e, void *callback_data); static int linked_attrs_add_backlinks_callback(Slapi_Entry *e, void *callback_data); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); /* * Function Implementations @@ -459,22 +458,3 @@ done: return rc; } - -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} diff --git a/ldap/servers/plugins/memberof/memberof.c b/ldap/servers/plugins/memberof/memberof.c index 87313ff..26236dc 100644 --- a/ldap/servers/plugins/memberof/memberof.c +++ b/ldap/servers/plugins/memberof/memberof.c @@ -142,7 +142,6 @@ static int memberof_replace_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *con static int memberof_modop_one_replace_r(Slapi_PBlock *pb, MemberOfConfig *config, int mod_op, Slapi_DN *group_sdn, Slapi_DN *op_this_sdn, Slapi_DN *replace_with_sdn, Slapi_DN *op_to_sdn, memberofstringll *stack); static int memberof_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static void memberof_task_destructor(Slapi_Task *task); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static void memberof_fixup_task_thread(void *arg); static int memberof_fix_memberof(MemberOfConfig *config, Slapi_Task *task, task_data *td); static int memberof_fix_memberof_callback(Slapi_Entry *e, void *callback_data); @@ -2871,22 +2870,6 @@ done: "memberof_fixup_task_thread - refcount decremented.\n"); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - int memberof_task_add(Slapi_PBlock *pb, Slapi_Entry *e, diff --git a/ldap/servers/plugins/posix-winsync/posix-group-task.c b/ldap/servers/plugins/posix-winsync/posix-group-task.c index b4c5075..d8b6add 100644 --- a/ldap/servers/plugins/posix-winsync/posix-group-task.c +++ b/ldap/servers/plugins/posix-winsync/posix-group-task.c @@ -42,22 +42,6 @@ posix_group_fixup_task_thread(void *arg); static int posix_group_fix_memberuid_callback(Slapi_Entry *e, void *callback_data); -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - /* e configEntry */ int posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)), @@ -82,7 +66,7 @@ posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)), /* get arg(s) */ /* default: set replication basedn */ - if ((dn = fetch_attr(e, "basedn", slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) { + if ((dn = fetch_attr(e, "basedn", (char *)slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) { *returncode = LDAP_OBJECT_CLASS_VIOLATION; rv = SLAPI_DSE_CALLBACK_ERROR; goto out; diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c index ea430d9..84e0263 100644 --- a/ldap/servers/plugins/replication/repl5_replica_config.c +++ b/ldap/servers/plugins/replication/repl5_replica_config.c @@ -1353,19 +1353,6 @@ replica_execute_cleanruv_task(Object *r, ReplicaId rid, char *returntext __attri return LDAP_SUCCESS; } -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - static int replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)), Slapi_Entry *e, diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c index f350b6d..f6898d0 100644 --- a/ldap/servers/plugins/replication/windows_protocol_util.c +++ b/ldap/servers/plugins/replication/windows_protocol_util.c @@ -720,39 +720,79 @@ send_password_modify(Slapi_DN *sdn, } else { Slapi_Attr *attr = NULL; int force_reset_pw = 0; + int pwd_already_reset = 0; + int ds_must_change = config_get_pw_must_change(); + /* - * If AD entry has password must change flag is set, - * we keep the flag (pwdLastSet == 0). - * msdn.microsoft.com: Windows Dev Centor - Desktop - * To force a user to change their password at next logon, - * set the pwdLastSet attribute to zero (0). - */ + * If AD entry has password must change flag is set, + * we keep the flag (pwdLastSet == 0). + * msdn.microsoft.com: Windows Dev Centor - Desktop + * To force a user to change their password at next logon, + * set the pwdLastSet attribute to zero (0). + */ if (remote_entry && (0 == slapi_entry_attr_find(remote_entry, "pwdLastSet", &attr)) && - attr) { + attr) + { Slapi_Value *v = NULL; int i = 0; + for (i = slapi_attr_first_value(attr, &v); v && (i != -1); - i = slapi_attr_next_value(attr, i, &v)) { + i = slapi_attr_next_value(attr, i, &v)) + { const char *s = slapi_value_get_string(v); if (NULL == s) { continue; } if (0 == strcmp(s, "0")) { - slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, - "%s: AD entry %s set \"user must change password at next logon\". ", - agmt_get_long_name(prp->agmt), slapi_entry_get_dn(remote_entry)); force_reset_pw = 1; + if (ds_must_change) { + /* + * DS already enforces "password must be changed after reset". + * Do an internal search and check the passwordExpirationtime + * to see if is it actually needs to be reset. If it doesn't, + * then set pwdLastSet to -1 + */ + char *expiration_val; + int rc = 0; + Slapi_DN *local_sdn = NULL; + + rc = map_entry_dn_inbound(remote_entry, &local_sdn, prp->agmt); + if ((0 == rc) && local_sdn) { + Slapi_Entry *local_entry = NULL; + /* Get the local entry if it exists */ + rc = windows_get_local_entry(local_sdn, &local_entry); + if ((0 == rc) && local_entry) { + expiration_val = (char *)fetch_attr(local_entry, "passwordExpirationtime", NULL); + if (expiration_val && parse_genTime(expiration_val) != NO_TIME){ + /* The user did reset their password */ + slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, + "send_password_modify - entry (%s) password was reset by user send that info to AD\n", + slapi_sdn_get_dn(local_sdn)); + pwd_already_reset = 1; + force_reset_pw = 0; + } + slapi_entry_free(local_entry); + } + } + slapi_sdn_free(&local_sdn); + } else { + slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, + "%s: AD entry %s set \"user must change password at next logon\n", + agmt_get_long_name(prp->agmt), slapi_entry_get_dn(remote_entry));; + } } } } - /* We will attempt to bind to AD with the new password first. We do - * this to avoid playing a password change that originated from AD - * back to AD. If we just played the password change back, then - * both sides would be in sync, but AD would contain the new password - * twice in it's password history, which undermines the password - * history policies in AD. */ + /* + * We will attempt to bind to AD with the new password first. We do + * this to avoid playing a password change that originated from AD + * back to AD. If we just played the password change back, then + * both sides would be in sync, but AD would contain the new password + * twice in it's password history, which undermines the password + * history policies in AD. + */ if (windows_check_user_password(prp->conn, sdn, password)) { char *quoted_password = NULL; /* AD wants the password in quotes ! */ @@ -792,9 +832,18 @@ send_password_modify(Slapi_DN *sdn, pw_mod.mod_bvalues = bvals; pw_mods[0] = &pw_mod; - if (force_reset_pw) { - reset_bv.bv_len = 1; - reset_bv.bv_val = "0"; + + if (force_reset_pw || pwd_already_reset) { + if (force_reset_pw) { + reset_bv.bv_val = "0"; + reset_bv.bv_len = 1; + } else if (pwd_already_reset) { + /* Password was reset by the user, there is no + * need to make the user change their password + * again in AD so set pwdLastSet to -1 */ + reset_bv.bv_val = "-1"; + reset_bv.bv_len = 2; + } reset_bvals[0] = &reset_bv; reset_bvals[1] = NULL; reset_pw_mod.mod_type = "pwdLastSet"; @@ -807,7 +856,6 @@ send_password_modify(Slapi_DN *sdn, } pw_return = windows_conn_send_modify(prp->conn, slapi_sdn_get_dn(sdn), pw_mods, NULL, NULL); - slapi_ch_free((void **)&unicode_password); } PR_smprintf_free(quoted_password); diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c index ee3b00c..c2399e5 100644 --- a/ldap/servers/plugins/schema_reload/schema_reload.c +++ b/ldap/servers/plugins/schema_reload/schema_reload.c @@ -187,23 +187,6 @@ schemareload_thread(void *arg) "schemareload_thread <-- refcount decremented.\n"); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - static void schemareload_destructor(Slapi_Task *task) { diff --git a/ldap/servers/plugins/syntaxes/validate_task.c b/ldap/servers/plugins/syntaxes/validate_task.c index 2c625ba..afec9ef 100644 --- a/ldap/servers/plugins/syntaxes/validate_task.c +++ b/ldap/servers/plugins/syntaxes/validate_task.c @@ -43,7 +43,6 @@ static int syntax_validate_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entr static void syntax_validate_task_destructor(Slapi_Task *task); static void syntax_validate_task_thread(void *arg); static int syntax_validate_task_callback(Slapi_Entry *e, void *callback_data); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static void syntax_validate_set_plugin_id(void *plugin_id); static void *syntax_validate_get_plugin_id(void); @@ -258,25 +257,6 @@ bail: return rc; } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - /* * Plug-in identity management helper functions */ diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index 4b75654..bdad4e5 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -8294,6 +8294,8 @@ int32_t slapi_atomic_decr_32(int32_t *ptr, int memorder); */ uint64_t slapi_atomic_decr_64(uint64_t *ptr, int memorder); +/* helper function */ +const char * fetch_attr(Slapi_Entry *e, const char *attrname, char *default_val); #ifdef __cplusplus } diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c index 3f9d5d9..698ee19 100644 --- a/ldap/servers/slapd/task.c +++ b/ldap/servers/slapd/task.c @@ -80,7 +80,6 @@ static void destroy_task(time_t when, void *arg); static int task_modify(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static int task_deny(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static void task_generic_destructor(Slapi_Task *task); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static Slapi_Entry *get_internal_entry(Slapi_PBlock *pb, char *dn); static void modify_internal_entry(char *dn, LDAPMod **mods); static void fixup_tombstone_task_destructor(Slapi_Task *task); @@ -684,22 +683,6 @@ destroy_task(time_t when, void *arg) slapi_ch_free((void **)&task); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - /* supply the pblock, destroy it when you're done */ static Slapi_Entry * get_internal_entry(Slapi_PBlock *pb, char *dn) diff --git a/ldap/servers/slapd/test-plugins/sampletask.c b/ldap/servers/slapd/test-plugins/sampletask.c index d04f21b..22d43dd 100644 --- a/ldap/servers/slapd/test-plugins/sampletask.c +++ b/ldap/servers/slapd/test-plugins/sampletask.c @@ -116,22 +116,6 @@ task_sampletask_thread(void *arg) slapi_task_finish(task, rv); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - static void task_sampletask_destructor(Slapi_Task *task) { diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c index cb46efb..8563c5d 100644 --- a/ldap/servers/slapd/util.c +++ b/ldap/servers/slapd/util.c @@ -1579,3 +1579,20 @@ slapi_create_errormsg( va_end(ap); } } + +/* + * Extract a single value from an entry (as a string) -- if it's not in the + * entry, the default will be returned (which can be NULL). You do not need + * to free the returned string value. + */ +const char * +fetch_attr(Slapi_Entry *e, const char *attrname, char *default_val) +{ + Slapi_Attr *attr; + Slapi_Value *val = NULL; + + if (slapi_entry_attr_find(e, attrname, &attr) != 0) + return default_val; + slapi_attr_first_value(attr, &val); + return slapi_value_get_string(val); +} -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.9 updated: Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user
by git repository hosting 27 Nov '18

27 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.9 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.9 by this push: new ac500d3 Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user ac500d3 is described below commit ac500d378aa22d5e818b110074ac9cd3e421e38d Author: Mark Reynolds <mreynolds(a)redhat.com> AuthorDate: Fri Sep 14 11:24:35 2018 -0400 Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user Bug Description: If a user's password was reset by an "Admin" or directory manager, the password policy requires a user must change their password after it's been "reset", and the user then resets their password in DS, this information was not sent to AD. Then if the user logged in AD after resetting their password in DS they still get forced to change their password again in AD. Fix Description: When sending a password update to AD, and AD is enforcing password must be reset, check if the user's did reset thier password. If so, set the correct "pwdLastSet" value to prevent AD from forcing that user to change their password again. But this only works going from DS to AD. The information needed to make it work from AD -> DS is not available to passSync, and if it was available it could not be correctly sent to DS anyway (not without a major redesign). Side Note: Also moved iand consolidated the function "fetch_attr" to util.c. It was reused and redefined in many plugins. So I added the definition to slapi-plugin.h and removed the duplicate definitions. https://pagure.io/389-ds-base/issue/49950 Reviewed by: tbordaz(Thanks!) (cherry picked from commit d9437be2e60fdbd6a5f1364f5887e1a3c89cda68) --- ldap/servers/plugins/automember/automember.c | 20 ----- ldap/servers/plugins/linkedattrs/fixup_task.c | 20 ----- ldap/servers/plugins/memberof/memberof.c | 17 ---- .../plugins/posix-winsync/posix-group-task.c | 18 +---- .../plugins/replication/repl5_replica_config.c | 13 ---- .../plugins/replication/windows_protocol_util.c | 90 +++++++++++++++++----- ldap/servers/plugins/schema_reload/schema_reload.c | 17 ---- ldap/servers/plugins/syntaxes/validate_task.c | 20 ----- ldap/servers/slapd/slapi-plugin.h | 2 + ldap/servers/slapd/task.c | 17 ---- ldap/servers/slapd/test-plugins/sampletask.c | 16 ---- ldap/servers/slapd/util.c | 17 ++++ 12 files changed, 89 insertions(+), 178 deletions(-) diff --git a/ldap/servers/plugins/automember/automember.c b/ldap/servers/plugins/automember/automember.c index c91aa4e..d982d49 100644 --- a/ldap/servers/plugins/automember/automember.c +++ b/ldap/servers/plugins/automember/automember.c @@ -74,7 +74,6 @@ static void automember_free_regex_rule(struct automemberRegexRule *rule); static int automember_parse_grouping_attr(char *value, char **grouping_attr, char **grouping_value); static int automember_update_membership(struct configEntry *config, Slapi_Entry *e, PRFileDesc *ldif_fd); static int automember_add_member_value(Slapi_Entry *member_e, const char *group_dn, char *grouping_attr, char *grouping_value, PRFileDesc *ldif_fd); -const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); /* * task functions @@ -1927,25 +1926,6 @@ typedef struct _task_data int scope; } task_data; -/* - * extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Value *val = NULL; - Slapi_Attr *attr; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - static void automember_task_destructor(Slapi_Task *task) { diff --git a/ldap/servers/plugins/linkedattrs/fixup_task.c b/ldap/servers/plugins/linkedattrs/fixup_task.c index 900ee11..4929714 100644 --- a/ldap/servers/plugins/linkedattrs/fixup_task.c +++ b/ldap/servers/plugins/linkedattrs/fixup_task.c @@ -22,7 +22,6 @@ static void linked_attrs_fixup_task_thread(void *arg); static void linked_attrs_fixup_links(struct configEntry *config); static int linked_attrs_remove_backlinks_callback(Slapi_Entry *e, void *callback_data); static int linked_attrs_add_backlinks_callback(Slapi_Entry *e, void *callback_data); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); /* * Function Implementations @@ -459,22 +458,3 @@ done: return rc; } - -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} diff --git a/ldap/servers/plugins/memberof/memberof.c b/ldap/servers/plugins/memberof/memberof.c index 87313ff..26236dc 100644 --- a/ldap/servers/plugins/memberof/memberof.c +++ b/ldap/servers/plugins/memberof/memberof.c @@ -142,7 +142,6 @@ static int memberof_replace_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *con static int memberof_modop_one_replace_r(Slapi_PBlock *pb, MemberOfConfig *config, int mod_op, Slapi_DN *group_sdn, Slapi_DN *op_this_sdn, Slapi_DN *replace_with_sdn, Slapi_DN *op_to_sdn, memberofstringll *stack); static int memberof_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static void memberof_task_destructor(Slapi_Task *task); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static void memberof_fixup_task_thread(void *arg); static int memberof_fix_memberof(MemberOfConfig *config, Slapi_Task *task, task_data *td); static int memberof_fix_memberof_callback(Slapi_Entry *e, void *callback_data); @@ -2871,22 +2870,6 @@ done: "memberof_fixup_task_thread - refcount decremented.\n"); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - int memberof_task_add(Slapi_PBlock *pb, Slapi_Entry *e, diff --git a/ldap/servers/plugins/posix-winsync/posix-group-task.c b/ldap/servers/plugins/posix-winsync/posix-group-task.c index b4c5075..d8b6add 100644 --- a/ldap/servers/plugins/posix-winsync/posix-group-task.c +++ b/ldap/servers/plugins/posix-winsync/posix-group-task.c @@ -42,22 +42,6 @@ posix_group_fixup_task_thread(void *arg); static int posix_group_fix_memberuid_callback(Slapi_Entry *e, void *callback_data); -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - /* e configEntry */ int posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)), @@ -82,7 +66,7 @@ posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)), /* get arg(s) */ /* default: set replication basedn */ - if ((dn = fetch_attr(e, "basedn", slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) { + if ((dn = fetch_attr(e, "basedn", (char *)slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) { *returncode = LDAP_OBJECT_CLASS_VIOLATION; rv = SLAPI_DSE_CALLBACK_ERROR; goto out; diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c index ea430d9..84e0263 100644 --- a/ldap/servers/plugins/replication/repl5_replica_config.c +++ b/ldap/servers/plugins/replication/repl5_replica_config.c @@ -1353,19 +1353,6 @@ replica_execute_cleanruv_task(Object *r, ReplicaId rid, char *returntext __attri return LDAP_SUCCESS; } -const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - static int replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)), Slapi_Entry *e, diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c index f350b6d..f6898d0 100644 --- a/ldap/servers/plugins/replication/windows_protocol_util.c +++ b/ldap/servers/plugins/replication/windows_protocol_util.c @@ -720,39 +720,79 @@ send_password_modify(Slapi_DN *sdn, } else { Slapi_Attr *attr = NULL; int force_reset_pw = 0; + int pwd_already_reset = 0; + int ds_must_change = config_get_pw_must_change(); + /* - * If AD entry has password must change flag is set, - * we keep the flag (pwdLastSet == 0). - * msdn.microsoft.com: Windows Dev Centor - Desktop - * To force a user to change their password at next logon, - * set the pwdLastSet attribute to zero (0). - */ + * If AD entry has password must change flag is set, + * we keep the flag (pwdLastSet == 0). + * msdn.microsoft.com: Windows Dev Centor - Desktop + * To force a user to change their password at next logon, + * set the pwdLastSet attribute to zero (0). + */ if (remote_entry && (0 == slapi_entry_attr_find(remote_entry, "pwdLastSet", &attr)) && - attr) { + attr) + { Slapi_Value *v = NULL; int i = 0; + for (i = slapi_attr_first_value(attr, &v); v && (i != -1); - i = slapi_attr_next_value(attr, i, &v)) { + i = slapi_attr_next_value(attr, i, &v)) + { const char *s = slapi_value_get_string(v); if (NULL == s) { continue; } if (0 == strcmp(s, "0")) { - slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, - "%s: AD entry %s set \"user must change password at next logon\". ", - agmt_get_long_name(prp->agmt), slapi_entry_get_dn(remote_entry)); force_reset_pw = 1; + if (ds_must_change) { + /* + * DS already enforces "password must be changed after reset". + * Do an internal search and check the passwordExpirationtime + * to see if is it actually needs to be reset. If it doesn't, + * then set pwdLastSet to -1 + */ + char *expiration_val; + int rc = 0; + Slapi_DN *local_sdn = NULL; + + rc = map_entry_dn_inbound(remote_entry, &local_sdn, prp->agmt); + if ((0 == rc) && local_sdn) { + Slapi_Entry *local_entry = NULL; + /* Get the local entry if it exists */ + rc = windows_get_local_entry(local_sdn, &local_entry); + if ((0 == rc) && local_entry) { + expiration_val = (char *)fetch_attr(local_entry, "passwordExpirationtime", NULL); + if (expiration_val && parse_genTime(expiration_val) != NO_TIME){ + /* The user did reset their password */ + slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, + "send_password_modify - entry (%s) password was reset by user send that info to AD\n", + slapi_sdn_get_dn(local_sdn)); + pwd_already_reset = 1; + force_reset_pw = 0; + } + slapi_entry_free(local_entry); + } + } + slapi_sdn_free(&local_sdn); + } else { + slapi_log_err(SLAPI_LOG_REPL, windows_repl_plugin_name, + "%s: AD entry %s set \"user must change password at next logon\n", + agmt_get_long_name(prp->agmt), slapi_entry_get_dn(remote_entry));; + } } } } - /* We will attempt to bind to AD with the new password first. We do - * this to avoid playing a password change that originated from AD - * back to AD. If we just played the password change back, then - * both sides would be in sync, but AD would contain the new password - * twice in it's password history, which undermines the password - * history policies in AD. */ + /* + * We will attempt to bind to AD with the new password first. We do + * this to avoid playing a password change that originated from AD + * back to AD. If we just played the password change back, then + * both sides would be in sync, but AD would contain the new password + * twice in it's password history, which undermines the password + * history policies in AD. + */ if (windows_check_user_password(prp->conn, sdn, password)) { char *quoted_password = NULL; /* AD wants the password in quotes ! */ @@ -792,9 +832,18 @@ send_password_modify(Slapi_DN *sdn, pw_mod.mod_bvalues = bvals; pw_mods[0] = &pw_mod; - if (force_reset_pw) { - reset_bv.bv_len = 1; - reset_bv.bv_val = "0"; + + if (force_reset_pw || pwd_already_reset) { + if (force_reset_pw) { + reset_bv.bv_val = "0"; + reset_bv.bv_len = 1; + } else if (pwd_already_reset) { + /* Password was reset by the user, there is no + * need to make the user change their password + * again in AD so set pwdLastSet to -1 */ + reset_bv.bv_val = "-1"; + reset_bv.bv_len = 2; + } reset_bvals[0] = &reset_bv; reset_bvals[1] = NULL; reset_pw_mod.mod_type = "pwdLastSet"; @@ -807,7 +856,6 @@ send_password_modify(Slapi_DN *sdn, } pw_return = windows_conn_send_modify(prp->conn, slapi_sdn_get_dn(sdn), pw_mods, NULL, NULL); - slapi_ch_free((void **)&unicode_password); } PR_smprintf_free(quoted_password); diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c index ee3b00c..c2399e5 100644 --- a/ldap/servers/plugins/schema_reload/schema_reload.c +++ b/ldap/servers/plugins/schema_reload/schema_reload.c @@ -187,23 +187,6 @@ schemareload_thread(void *arg) "schemareload_thread <-- refcount decremented.\n"); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - static void schemareload_destructor(Slapi_Task *task) { diff --git a/ldap/servers/plugins/syntaxes/validate_task.c b/ldap/servers/plugins/syntaxes/validate_task.c index 2c625ba..afec9ef 100644 --- a/ldap/servers/plugins/syntaxes/validate_task.c +++ b/ldap/servers/plugins/syntaxes/validate_task.c @@ -43,7 +43,6 @@ static int syntax_validate_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entr static void syntax_validate_task_destructor(Slapi_Task *task); static void syntax_validate_task_thread(void *arg); static int syntax_validate_task_callback(Slapi_Entry *e, void *callback_data); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static void syntax_validate_set_plugin_id(void *plugin_id); static void *syntax_validate_get_plugin_id(void); @@ -258,25 +257,6 @@ bail: return rc; } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) { - return default_val; - } - - slapi_attr_first_value(attr, &val); - - return slapi_value_get_string(val); -} - /* * Plug-in identity management helper functions */ diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index 4b75654..bdad4e5 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -8294,6 +8294,8 @@ int32_t slapi_atomic_decr_32(int32_t *ptr, int memorder); */ uint64_t slapi_atomic_decr_64(uint64_t *ptr, int memorder); +/* helper function */ +const char * fetch_attr(Slapi_Entry *e, const char *attrname, char *default_val); #ifdef __cplusplus } diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c index 3f9d5d9..698ee19 100644 --- a/ldap/servers/slapd/task.c +++ b/ldap/servers/slapd/task.c @@ -80,7 +80,6 @@ static void destroy_task(time_t when, void *arg); static int task_modify(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static int task_deny(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); static void task_generic_destructor(Slapi_Task *task); -static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val); static Slapi_Entry *get_internal_entry(Slapi_PBlock *pb, char *dn); static void modify_internal_entry(char *dn, LDAPMod **mods); static void fixup_tombstone_task_destructor(Slapi_Task *task); @@ -684,22 +683,6 @@ destroy_task(time_t when, void *arg) slapi_ch_free((void **)&task); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - /* supply the pblock, destroy it when you're done */ static Slapi_Entry * get_internal_entry(Slapi_PBlock *pb, char *dn) diff --git a/ldap/servers/slapd/test-plugins/sampletask.c b/ldap/servers/slapd/test-plugins/sampletask.c index d04f21b..22d43dd 100644 --- a/ldap/servers/slapd/test-plugins/sampletask.c +++ b/ldap/servers/slapd/test-plugins/sampletask.c @@ -116,22 +116,6 @@ task_sampletask_thread(void *arg) slapi_task_finish(task, rv); } -/* extract a single value from the entry (as a string) -- if it's not in the - * entry, the default will be returned (which can be NULL). - * you do not need to free anything returned by this. - */ -static const char * -fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val) -{ - Slapi_Attr *attr; - Slapi_Value *val = NULL; - - if (slapi_entry_attr_find(e, attrname, &attr) != 0) - return default_val; - slapi_attr_first_value(attr, &val); - return slapi_value_get_string(val); -} - static void task_sampletask_destructor(Slapi_Task *task) { diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c index cb46efb..8563c5d 100644 --- a/ldap/servers/slapd/util.c +++ b/ldap/servers/slapd/util.c @@ -1579,3 +1579,20 @@ slapi_create_errormsg( va_end(ap); } } + +/* + * Extract a single value from an entry (as a string) -- if it's not in the + * entry, the default will be returned (which can be NULL). You do not need + * to free the returned string value. + */ +const char * +fetch_attr(Slapi_Entry *e, const char *attrname, char *default_val) +{ + Slapi_Attr *attr; + Slapi_Value *val = NULL; + + if (slapi_entry_attr_find(e, attrname, &attr) != 0) + return default_val; + slapi_attr_first_value(attr, &val); + return slapi_value_get_string(val); +} -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (a8f62ee -> d9437be)
by git repository hosting 27 Nov '18

27 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a change to branch master in repository 389-ds-base. from a8f62ee Ticket 50046 - Remove irrelevant debug-log messages from CLI tools add d9437be Ticket 49950 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user No new revisions were added by this update. Summary of changes: ldap/servers/plugins/automember/automember.c | 20 ----- ldap/servers/plugins/linkedattrs/fixup_task.c | 20 ----- ldap/servers/plugins/memberof/memberof.c | 17 ---- .../plugins/posix-winsync/posix-group-task.c | 18 +---- .../plugins/replication/repl5_replica_config.c | 13 ---- .../plugins/replication/windows_protocol_util.c | 90 +++++++++++++++++----- ldap/servers/plugins/schema_reload/schema_reload.c | 17 ---- ldap/servers/plugins/syntaxes/validate_task.c | 20 ----- ldap/servers/slapd/slapi-plugin.h | 2 + ldap/servers/slapd/task.c | 17 ---- ldap/servers/slapd/test-plugins/sampletask.c | 16 ---- ldap/servers/slapd/util.c | 17 ++++ 12 files changed, 89 insertions(+), 178 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (4fd73c5 -> a8f62ee)
by git repository hosting 27 Nov '18

27 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a change to branch master in repository 389-ds-base. from 4fd73c5 Ticket 50022, 50012, 49956, and 49800: Various dsctl/dscreate fixes add a8f62ee Ticket 50046 - Remove irrelevant debug-log messages from CLI tools No new revisions were added by this update. Summary of changes: src/lib389/cli/dsconf | 1 - src/lib389/cli/dscreate | 2 -- src/lib389/cli/dsctl | 2 -- src/lib389/cli/dsidm | 2 -- 4 files changed, 7 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (6fe6101 -> 4fd73c5)
by git repository hosting 26 Nov '18

26 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a change to branch master in repository 389-ds-base. from 6fe6101 Ticket 49927 - dsctl db2index does not work add 4fd73c5 Ticket 50022, 50012, 49956, and 49800: Various dsctl/dscreate fixes No new revisions were added by this update. Summary of changes: docker/389ds_poc/Dockerfile | 2 +- src/cockpit/389-console/src/servers.js | 4 +- src/lib389/cli/dscreate | 2 +- src/lib389/cli/dsctl | 27 +++++++++++++- src/lib389/lib389/__init__.py | 12 +++--- src/lib389/lib389/cli_ctl/instance.py | 67 ++++++++++++++++++++++++++-------- src/lib389/lib389/paths.py | 1 + src/lib389/lib389/tools.py | 8 ++-- src/lib389/lib389/utils.py | 16 ++++++++ 9 files changed, 107 insertions(+), 32 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (5d611f1 -> 6fe6101)
by git repository hosting 26 Nov '18

26 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a change to branch master in repository 389-ds-base. from 5d611f1 Ticket 49814 - dscreate should handle selinux ports that are in a range add 6fe6101 Ticket 49927 - dsctl db2index does not work No new revisions were added by this update. Summary of changes: src/lib389/lib389/__init__.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.8 updated: Ticket 49543 - fix certmap dn comparison
by git repository hosting 26 Nov '18

26 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.8 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.8 by this push: new 818807d Ticket 49543 - fix certmap dn comparison 818807d is described below commit 818807d551e211298e205313b7c29f8318403081 Author: Fraser Tweedale <ftweedal(a)redhat.com> AuthorDate: Fri Mar 16 15:16:56 2018 +1000 Ticket 49543 - fix certmap dn comparison Bug Description: Differences in DN string representations between the value included in certmap.conf, and the stringified value of the Issuer DN produced by NSS, as well as buggy DN normalisation code in 389 itself, cause 389 to wrongly reject the correct certmap configuration to use. Authentication fails. This behaviour was observed when there is an escaped comma in an attribute value. Fix Description: Instead of comparing stringified DNs, parse the DN represented in certmap.conf into an NSS CertNAME. Use the NSS DN comparison routine when comparing certificate Issuer DNs against the certmap configurations. Remove the buggy DN normalisation routine. https://pagure.io/389-ds-base/issue/49543 Author: Fraser Tweedale <ftweedal(a)redhat.com> Review by: ??? --- include/ldaputil/certmap.h | 20 +++--- include/ldaputil/ldaputil.h | 2 +- lib/ldaputil/cert.c | 27 ++++++-- lib/ldaputil/certmap.c | 162 +++++++------------------------------------ lib/ldaputil/examples/init.c | 3 +- 5 files changed, 62 insertions(+), 152 deletions(-) diff --git a/include/ldaputil/certmap.h b/include/ldaputil/certmap.h index fec2dd9..50fd4d1 100644 --- a/include/ldaputil/certmap.h +++ b/include/ldaputil/certmap.h @@ -16,6 +16,7 @@ /* What was extcmap.h begins ... */ #include <ldap.h> +#include <nss3/cert.h> #ifndef NSAPI_PUBLIC #define NSAPI_PUBLIC @@ -156,7 +157,7 @@ typedef int (*CertVerifyFn_t)(void *cert, LDAP *ld, void *certmap_info, LDAPMess * otherwise return LDAPU_CERT_MAP_INITFN_FAILED. The server startup will be * aborted if the return value is not LDAPU_SUCCESS. */ -typedef int (*CertMapInitFn_t)(void *certmap_info, const char *issuerName, const char *issuerDN, const char *libname); +typedef int (*CertMapInitFn_t)(void *certmap_info, const char *issuerName, const CERTName *issuerDN, const char *libname); /* * Refer to the description of the function ldapu_get_cert_ava_val @@ -209,27 +210,30 @@ extern "C" { NSAPI_PUBLIC int ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage **res); -NSAPI_PUBLIC int ldapu_set_cert_mapfn(const char *issuerDN, +NSAPI_PUBLIC int ldapu_set_cert_mapfn(const CERTName *issuerDN, CertMapFn_t mapfn); -NSAPI_PUBLIC CertMapFn_t ldapu_get_cert_mapfn(const char *issuerDN); +NSAPI_PUBLIC CertMapFn_t ldapu_get_cert_mapfn(const CERTName *issuerDN); -NSAPI_PUBLIC int ldapu_set_cert_searchfn(const char *issuerDN, +NSAPI_PUBLIC int ldapu_set_cert_searchfn(const CERTName *issuerDN, CertSearchFn_t searchfn); -NSAPI_PUBLIC CertSearchFn_t ldapu_get_cert_searchfn(const char *issuerDN); +NSAPI_PUBLIC CertSearchFn_t ldapu_get_cert_searchfn(const CERTName *issuerDN); -NSAPI_PUBLIC int ldapu_set_cert_verifyfn(const char *issuerDN, +NSAPI_PUBLIC int ldapu_set_cert_verifyfn(const CERTName *issuerDN, CertVerifyFn_t verifyFn); -NSAPI_PUBLIC CertVerifyFn_t ldapu_get_cert_verifyfn(const char *issuerDN); +NSAPI_PUBLIC CertVerifyFn_t ldapu_get_cert_verifyfn(const CERTName *issuerDN); NSAPI_PUBLIC int ldapu_get_cert_subject_dn(void *cert, char **subjectDN); +NSAPI_PUBLIC CERTName *ldapu_get_cert_issuer_dn_as_CERTName(CERTCertificate *cert); + + NSAPI_PUBLIC int ldapu_get_cert_issuer_dn(void *cert, char **issuerDN); @@ -242,7 +246,7 @@ NSAPI_PUBLIC int ldapu_free_cert_ava_val(char **val); NSAPI_PUBLIC int ldapu_get_cert_der(void *cert, unsigned char **derCert, unsigned int *len); -NSAPI_PUBLIC int ldapu_issuer_certinfo(const char *issuerDN, +NSAPI_PUBLIC int ldapu_issuer_certinfo(const CERTName *issuerDN, void **certmap_info); diff --git a/include/ldaputil/ldaputil.h b/include/ldaputil/ldaputil.h index e0e028c..b172819 100644 --- a/include/ldaputil/ldaputil.h +++ b/include/ldaputil/ldaputil.h @@ -48,7 +48,7 @@ enum typedef struct { char *issuerName; /* issuer (symbolic/short) name */ - char *issuerDN; /* cert issuer's DN */ + CERTName *issuerDN; /* cert issuer's DN */ LDAPUPropValList_t *propval; /* pointer to the prop-val pairs list */ CertMapFn_t mapfn; /* cert to ldapdn & filter mapping func */ CertVerifyFn_t verifyfn; /* verify cert function */ diff --git a/lib/ldaputil/cert.c b/lib/ldaputil/cert.c index 65a4815..73abba1 100644 --- a/lib/ldaputil/cert.c +++ b/lib/ldaputil/cert.c @@ -54,15 +54,30 @@ ldapu_get_cert_subject_dn(void *cert_in, char **subjectDN) return *subjectDN ? LDAPU_SUCCESS : LDAPU_ERR_EXTRACT_SUBJECTDN_FAILED; } +/* + * Return the Issuer DN as a CERTName. + * The CERTName is owned by the CERTCertificate. + */ +NSAPI_PUBLIC CERTName * +ldapu_get_cert_issuer_dn_as_CERTName(CERTCertificate *cert_in) +{ + return &cert_in->issuer; +} + +/* + * Return the Issuer DN as a string. + * The string should be freed by the caller. + */ NSAPI_PUBLIC int ldapu_get_cert_issuer_dn(void *cert_in, char **issuerDN) { - CERTCertificate *cert = (CERTCertificate *)cert_in; - char *cert_issuer = CERT_NameToAscii(&cert->issuer); - - *issuerDN = strdup(cert_issuer); - PR_Free(cert_issuer); - + *issuerDN = NULL; + CERTName *dn = ldapu_get_cert_issuer_dn_as_CERTName((CERTCertificate *)cert_in); + if (dn != NULL) { + char *cert_issuer = CERT_NameToAscii(dn); + *issuerDN = strdup(cert_issuer); + PR_Free(cert_issuer); + } return *issuerDN ? LDAPU_SUCCESS : LDAPU_ERR_EXTRACT_ISSUERDN_FAILED; } diff --git a/lib/ldaputil/certmap.c b/lib/ldaputil/certmap.c index 78bb363..0db2de1 100644 --- a/lib/ldaputil/certmap.c +++ b/lib/ldaputil/certmap.c @@ -52,7 +52,6 @@ static char this_dllname[256]; static const char *LIB_DIRECTIVE = "certmap"; static const int LIB_DIRECTIVE_LEN = 7; /* strlen("LIB_DIRECTIVE") */ -static char *ldapu_dn_normalize(char *dn); static void *ldapu_propval_free(void *propval_in, void *arg); typedef struct @@ -337,8 +336,13 @@ dbinfo_to_certinfo(DBConfDBInfo_t *db_info, certinfo->issuerName = db_info->dbname; db_info->dbname = 0; - certinfo->issuerDN = ldapu_dn_normalize(db_info->url); - db_info->url = 0; + /* Parse the Issuer DN. */ + certinfo->issuerDN = CERT_AsciiToName(db_info->url); + if (NULL == certinfo->issuerDN /* invalid DN */ + && ldapu_strcasecmp(db_info->url, "default") != 0 /* not "default" */) { + rv = LDAPU_ERR_MALFORMED_SUBJECT_DN; + goto error; + } /* hijack actual prop-vals from dbinfo -- to avoid strdup calls */ if (db_info->firstprop) { @@ -890,24 +894,26 @@ ldapu_cert_searchfn_default(void *cert, LDAP *ld, void *certmap_info_in, const c } NSAPI_PUBLIC int -ldapu_issuer_certinfo(const char *issuerDN, void **certmap_info) +ldapu_issuer_certinfo(const CERTName *issuerDN, void **certmap_info) { *certmap_info = 0; - if (!issuerDN || !*issuerDN || !ldapu_strcasecmp(issuerDN, "default")) { - *certmap_info = default_certmap_info; - } else if (certmap_listinfo) { - char *n_issuerDN = ldapu_dn_normalize(ldapu_strdup(issuerDN)); + if (certmap_listinfo) { LDAPUListNode_t *cur = certmap_listinfo->head; while (cur) { - if (!ldapu_strcasecmp(n_issuerDN, ((LDAPUCertMapInfo_t *)cur->info)->issuerDN)) { + LDAPUCertMapInfo_t *info = (LDAPUCertMapInfo_t *)cur->info; + + if (NULL == info->issuerDN) { + /* no DN to compare to (probably the default certmap info) */ + continue; + } + + if (CERT_CompareName(issuerDN, info->issuerDN) == SECEqual) { *certmap_info = cur->info; break; } cur = cur->next; } - if (n_issuerDN) - ldapu_free(n_issuerDN); } return *certmap_info ? LDAPU_SUCCESS : LDAPU_FAILED; } @@ -1128,7 +1134,7 @@ ldapu_cert_mapfn_default(void *cert_in, LDAP *ld __attribute__((unused)), void * } NSAPI_PUBLIC int -ldapu_set_cert_mapfn(const char *issuerDN, +ldapu_set_cert_mapfn(const CERTName *issuerDN, CertMapFn_t mapfn) { LDAPUCertMapInfo_t *certmap_info; @@ -1161,7 +1167,7 @@ ldapu_get_cert_mapfn_sub(LDAPUCertMapInfo_t *certmap_info) } NSAPI_PUBLIC CertMapFn_t -ldapu_get_cert_mapfn(const char *issuerDN) +ldapu_get_cert_mapfn(const CERTName *issuerDN) { LDAPUCertMapInfo_t *certmap_info = 0; @@ -1173,7 +1179,7 @@ ldapu_get_cert_mapfn(const char *issuerDN) } NSAPI_PUBLIC int -ldapu_set_cert_searchfn(const char *issuerDN, +ldapu_set_cert_searchfn(const CERTName *issuerDN, CertSearchFn_t searchfn) { LDAPUCertMapInfo_t *certmap_info; @@ -1206,7 +1212,7 @@ ldapu_get_cert_searchfn_sub(LDAPUCertMapInfo_t *certmap_info) } NSAPI_PUBLIC CertSearchFn_t -ldapu_get_cert_searchfn(const char *issuerDN) +ldapu_get_cert_searchfn(const CERTName *issuerDN) { LDAPUCertMapInfo_t *certmap_info = 0; @@ -1218,7 +1224,7 @@ ldapu_get_cert_searchfn(const char *issuerDN) } NSAPI_PUBLIC int -ldapu_set_cert_verifyfn(const char *issuerDN, +ldapu_set_cert_verifyfn(const CERTName *issuerDN, CertVerifyFn_t verifyfn) { LDAPUCertMapInfo_t *certmap_info; @@ -1251,7 +1257,7 @@ ldapu_get_cert_verifyfn_sub(LDAPUCertMapInfo_t *certmap_info) } NSAPI_PUBLIC CertVerifyFn_t -ldapu_get_cert_verifyfn(const char *issuerDN) +ldapu_get_cert_verifyfn(const CERTName *issuerDN) { LDAPUCertMapInfo_t *certmap_info = 0; @@ -1288,7 +1294,6 @@ static int ldapu_certinfo_copy (const LDAPUCertMapInfo_t *from, NSAPI_PUBLIC int ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage **res) { - char *issuerDN = 0; char *ldapDN = 0; char *filter = 0; LDAPUCertMapInfo_t *certmap_info; @@ -1308,14 +1313,14 @@ ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage * certmap_attrs[3] = 0; } - rv = ldapu_get_cert_issuer_dn(cert, &issuerDN); + CERTName *issuerDN = ldapu_get_cert_issuer_dn_as_CERTName(cert); + /* ^ don't need to free this; it will be freed with ^ the cert */ - if (rv != LDAPU_SUCCESS) + if (NULL == issuerDN) return LDAPU_ERR_NO_ISSUERDN_IN_CERT; /* don't free the certmap_info -- its a pointer to an internal structure */ rv = ldapu_issuer_certinfo(issuerDN, (void **)&certmap_info); - free(issuerDN); if (!certmap_info) certmap_info = default_certmap_info; @@ -1604,118 +1609,3 @@ ldapu_realloc(void *ptr, int size) { return realloc(ptr, size); } - -#define DNSEPARATOR(c) (c == ',' || c == ';') -#define SEPARATOR(c) (c == ',' || c == ';' || c == '+') -#define SPACE(c) (c == ' ' || c == '\n') -#define NEEDSESCAPE(c) (c == '\\' || c == '"') -#define B4TYPE 0 -#define INTYPE 1 -#define B4EQUAL 2 -#define B4VALUE 3 -#define INVALUE 4 -#define INQUOTEDVALUE 5 -#define B4SEPARATOR 6 - -static char * -ldapu_dn_normalize(char *dn) -{ - char *d, *s; - int state, gotesc; - - gotesc = 0; - state = B4TYPE; - for (d = s = dn; *s; s++) { - switch (state) { - case B4TYPE: - if (!SPACE(*s)) { - state = INTYPE; - *d++ = *s; - } - break; - case INTYPE: - if (*s == '=') { - state = B4VALUE; - *d++ = *s; - } else if (SPACE(*s)) { - state = B4EQUAL; - } else { - *d++ = *s; - } - break; - case B4EQUAL: - if (*s == '=') { - state = B4VALUE; - *d++ = *s; - } else if (!SPACE(*s)) { - /* not a valid dn - but what can we do here? */ - *d++ = *s; - } - break; - case B4VALUE: - if (*s == '"') { - state = INQUOTEDVALUE; - *d++ = *s; - } else if (!SPACE(*s)) { - state = INVALUE; - *d++ = *s; - } - break; - case INVALUE: - if (!gotesc && SEPARATOR(*s)) { - while (SPACE(*(d - 1))) - d--; - state = B4TYPE; - if (*s == '+') { - *d++ = *s; - } else { - *d++ = ','; - } - } else if (gotesc && !NEEDSESCAPE(*s) && - !SEPARATOR(*s)) { - *--d = *s; - d++; - } else { - *d++ = *s; - } - break; - case INQUOTEDVALUE: - if (!gotesc && *s == '"') { - state = B4SEPARATOR; - *d++ = *s; - } else if (gotesc && !NEEDSESCAPE(*s)) { - *--d = *s; - d++; - } else { - *d++ = *s; - } - break; - case B4SEPARATOR: - if (SEPARATOR(*s)) { - state = B4TYPE; - if (*s == '+') { - *d++ = *s; - } else { - *d++ = ','; - } - } - break; - default: - break; - } - if (*s == '\\') { - gotesc = 1; - } else { - gotesc = 0; - } - } - *d = '\0'; - - /* Trim trailing spaces */ - d--; - while (d >= dn && *d == ' ') { - *d-- = '\0'; - } - - return (dn); -} diff --git a/lib/ldaputil/examples/init.c b/lib/ldaputil/examples/init.c index 74db977..fd1edc9 100644 --- a/lib/ldaputil/examples/init.c +++ b/lib/ldaputil/examples/init.c @@ -15,12 +15,13 @@ #include <stdio.h> #include <string.h> #include <ctype.h> +#include <nss3/cert.h> #include "certmap.h" /* Public Certmap API */ #include "plugin.h" /* must define extern "C" functions */ NSAPI_PUBLIC int -plugin_init_fn(void *certmap_info, const char *issuerName, const char *issuerDN, const char *libname) +plugin_init_fn(void *certmap_info, const char *issuerName, const CERTName *issuerDN, const char *libname) { static int initialized = 0; int rv; -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch 389-ds-base-1.3.9 updated: Ticket 49543 - fix certmap dn comparison
by git repository hosting 26 Nov '18

26 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a commit to branch 389-ds-base-1.3.9 in repository 389-ds-base. The following commit(s) were added to refs/heads/389-ds-base-1.3.9 by this push: new 1a93d63 Ticket 49543 - fix certmap dn comparison 1a93d63 is described below commit 1a93d63fa1fa95599c0dda1a1f3b2a72ab90d634 Author: Fraser Tweedale <ftweedal(a)redhat.com> AuthorDate: Fri Mar 16 15:16:56 2018 +1000 Ticket 49543 - fix certmap dn comparison Bug Description: Differences in DN string representations between the value included in certmap.conf, and the stringified value of the Issuer DN produced by NSS, as well as buggy DN normalisation code in 389 itself, cause 389 to wrongly reject the correct certmap configuration to use. Authentication fails. This behaviour was observed when there is an escaped comma in an attribute value. Fix Description: Instead of comparing stringified DNs, parse the DN represented in certmap.conf into an NSS CertNAME. Use the NSS DN comparison routine when comparing certificate Issuer DNs against the certmap configurations. Remove the buggy DN normalisation routine. https://pagure.io/389-ds-base/issue/49543 Author: Fraser Tweedale <ftweedal(a)redhat.com> Review by: ??? --- include/ldaputil/certmap.h | 20 +++--- include/ldaputil/ldaputil.h | 2 +- lib/ldaputil/cert.c | 27 ++++++-- lib/ldaputil/certmap.c | 162 +++++++------------------------------------ lib/ldaputil/examples/init.c | 3 +- 5 files changed, 62 insertions(+), 152 deletions(-) diff --git a/include/ldaputil/certmap.h b/include/ldaputil/certmap.h index fec2dd9..50fd4d1 100644 --- a/include/ldaputil/certmap.h +++ b/include/ldaputil/certmap.h @@ -16,6 +16,7 @@ /* What was extcmap.h begins ... */ #include <ldap.h> +#include <nss3/cert.h> #ifndef NSAPI_PUBLIC #define NSAPI_PUBLIC @@ -156,7 +157,7 @@ typedef int (*CertVerifyFn_t)(void *cert, LDAP *ld, void *certmap_info, LDAPMess * otherwise return LDAPU_CERT_MAP_INITFN_FAILED. The server startup will be * aborted if the return value is not LDAPU_SUCCESS. */ -typedef int (*CertMapInitFn_t)(void *certmap_info, const char *issuerName, const char *issuerDN, const char *libname); +typedef int (*CertMapInitFn_t)(void *certmap_info, const char *issuerName, const CERTName *issuerDN, const char *libname); /* * Refer to the description of the function ldapu_get_cert_ava_val @@ -209,27 +210,30 @@ extern "C" { NSAPI_PUBLIC int ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage **res); -NSAPI_PUBLIC int ldapu_set_cert_mapfn(const char *issuerDN, +NSAPI_PUBLIC int ldapu_set_cert_mapfn(const CERTName *issuerDN, CertMapFn_t mapfn); -NSAPI_PUBLIC CertMapFn_t ldapu_get_cert_mapfn(const char *issuerDN); +NSAPI_PUBLIC CertMapFn_t ldapu_get_cert_mapfn(const CERTName *issuerDN); -NSAPI_PUBLIC int ldapu_set_cert_searchfn(const char *issuerDN, +NSAPI_PUBLIC int ldapu_set_cert_searchfn(const CERTName *issuerDN, CertSearchFn_t searchfn); -NSAPI_PUBLIC CertSearchFn_t ldapu_get_cert_searchfn(const char *issuerDN); +NSAPI_PUBLIC CertSearchFn_t ldapu_get_cert_searchfn(const CERTName *issuerDN); -NSAPI_PUBLIC int ldapu_set_cert_verifyfn(const char *issuerDN, +NSAPI_PUBLIC int ldapu_set_cert_verifyfn(const CERTName *issuerDN, CertVerifyFn_t verifyFn); -NSAPI_PUBLIC CertVerifyFn_t ldapu_get_cert_verifyfn(const char *issuerDN); +NSAPI_PUBLIC CertVerifyFn_t ldapu_get_cert_verifyfn(const CERTName *issuerDN); NSAPI_PUBLIC int ldapu_get_cert_subject_dn(void *cert, char **subjectDN); +NSAPI_PUBLIC CERTName *ldapu_get_cert_issuer_dn_as_CERTName(CERTCertificate *cert); + + NSAPI_PUBLIC int ldapu_get_cert_issuer_dn(void *cert, char **issuerDN); @@ -242,7 +246,7 @@ NSAPI_PUBLIC int ldapu_free_cert_ava_val(char **val); NSAPI_PUBLIC int ldapu_get_cert_der(void *cert, unsigned char **derCert, unsigned int *len); -NSAPI_PUBLIC int ldapu_issuer_certinfo(const char *issuerDN, +NSAPI_PUBLIC int ldapu_issuer_certinfo(const CERTName *issuerDN, void **certmap_info); diff --git a/include/ldaputil/ldaputil.h b/include/ldaputil/ldaputil.h index e0e028c..b172819 100644 --- a/include/ldaputil/ldaputil.h +++ b/include/ldaputil/ldaputil.h @@ -48,7 +48,7 @@ enum typedef struct { char *issuerName; /* issuer (symbolic/short) name */ - char *issuerDN; /* cert issuer's DN */ + CERTName *issuerDN; /* cert issuer's DN */ LDAPUPropValList_t *propval; /* pointer to the prop-val pairs list */ CertMapFn_t mapfn; /* cert to ldapdn & filter mapping func */ CertVerifyFn_t verifyfn; /* verify cert function */ diff --git a/lib/ldaputil/cert.c b/lib/ldaputil/cert.c index 65a4815..73abba1 100644 --- a/lib/ldaputil/cert.c +++ b/lib/ldaputil/cert.c @@ -54,15 +54,30 @@ ldapu_get_cert_subject_dn(void *cert_in, char **subjectDN) return *subjectDN ? LDAPU_SUCCESS : LDAPU_ERR_EXTRACT_SUBJECTDN_FAILED; } +/* + * Return the Issuer DN as a CERTName. + * The CERTName is owned by the CERTCertificate. + */ +NSAPI_PUBLIC CERTName * +ldapu_get_cert_issuer_dn_as_CERTName(CERTCertificate *cert_in) +{ + return &cert_in->issuer; +} + +/* + * Return the Issuer DN as a string. + * The string should be freed by the caller. + */ NSAPI_PUBLIC int ldapu_get_cert_issuer_dn(void *cert_in, char **issuerDN) { - CERTCertificate *cert = (CERTCertificate *)cert_in; - char *cert_issuer = CERT_NameToAscii(&cert->issuer); - - *issuerDN = strdup(cert_issuer); - PR_Free(cert_issuer); - + *issuerDN = NULL; + CERTName *dn = ldapu_get_cert_issuer_dn_as_CERTName((CERTCertificate *)cert_in); + if (dn != NULL) { + char *cert_issuer = CERT_NameToAscii(dn); + *issuerDN = strdup(cert_issuer); + PR_Free(cert_issuer); + } return *issuerDN ? LDAPU_SUCCESS : LDAPU_ERR_EXTRACT_ISSUERDN_FAILED; } diff --git a/lib/ldaputil/certmap.c b/lib/ldaputil/certmap.c index 78bb363..0db2de1 100644 --- a/lib/ldaputil/certmap.c +++ b/lib/ldaputil/certmap.c @@ -52,7 +52,6 @@ static char this_dllname[256]; static const char *LIB_DIRECTIVE = "certmap"; static const int LIB_DIRECTIVE_LEN = 7; /* strlen("LIB_DIRECTIVE") */ -static char *ldapu_dn_normalize(char *dn); static void *ldapu_propval_free(void *propval_in, void *arg); typedef struct @@ -337,8 +336,13 @@ dbinfo_to_certinfo(DBConfDBInfo_t *db_info, certinfo->issuerName = db_info->dbname; db_info->dbname = 0; - certinfo->issuerDN = ldapu_dn_normalize(db_info->url); - db_info->url = 0; + /* Parse the Issuer DN. */ + certinfo->issuerDN = CERT_AsciiToName(db_info->url); + if (NULL == certinfo->issuerDN /* invalid DN */ + && ldapu_strcasecmp(db_info->url, "default") != 0 /* not "default" */) { + rv = LDAPU_ERR_MALFORMED_SUBJECT_DN; + goto error; + } /* hijack actual prop-vals from dbinfo -- to avoid strdup calls */ if (db_info->firstprop) { @@ -890,24 +894,26 @@ ldapu_cert_searchfn_default(void *cert, LDAP *ld, void *certmap_info_in, const c } NSAPI_PUBLIC int -ldapu_issuer_certinfo(const char *issuerDN, void **certmap_info) +ldapu_issuer_certinfo(const CERTName *issuerDN, void **certmap_info) { *certmap_info = 0; - if (!issuerDN || !*issuerDN || !ldapu_strcasecmp(issuerDN, "default")) { - *certmap_info = default_certmap_info; - } else if (certmap_listinfo) { - char *n_issuerDN = ldapu_dn_normalize(ldapu_strdup(issuerDN)); + if (certmap_listinfo) { LDAPUListNode_t *cur = certmap_listinfo->head; while (cur) { - if (!ldapu_strcasecmp(n_issuerDN, ((LDAPUCertMapInfo_t *)cur->info)->issuerDN)) { + LDAPUCertMapInfo_t *info = (LDAPUCertMapInfo_t *)cur->info; + + if (NULL == info->issuerDN) { + /* no DN to compare to (probably the default certmap info) */ + continue; + } + + if (CERT_CompareName(issuerDN, info->issuerDN) == SECEqual) { *certmap_info = cur->info; break; } cur = cur->next; } - if (n_issuerDN) - ldapu_free(n_issuerDN); } return *certmap_info ? LDAPU_SUCCESS : LDAPU_FAILED; } @@ -1128,7 +1134,7 @@ ldapu_cert_mapfn_default(void *cert_in, LDAP *ld __attribute__((unused)), void * } NSAPI_PUBLIC int -ldapu_set_cert_mapfn(const char *issuerDN, +ldapu_set_cert_mapfn(const CERTName *issuerDN, CertMapFn_t mapfn) { LDAPUCertMapInfo_t *certmap_info; @@ -1161,7 +1167,7 @@ ldapu_get_cert_mapfn_sub(LDAPUCertMapInfo_t *certmap_info) } NSAPI_PUBLIC CertMapFn_t -ldapu_get_cert_mapfn(const char *issuerDN) +ldapu_get_cert_mapfn(const CERTName *issuerDN) { LDAPUCertMapInfo_t *certmap_info = 0; @@ -1173,7 +1179,7 @@ ldapu_get_cert_mapfn(const char *issuerDN) } NSAPI_PUBLIC int -ldapu_set_cert_searchfn(const char *issuerDN, +ldapu_set_cert_searchfn(const CERTName *issuerDN, CertSearchFn_t searchfn) { LDAPUCertMapInfo_t *certmap_info; @@ -1206,7 +1212,7 @@ ldapu_get_cert_searchfn_sub(LDAPUCertMapInfo_t *certmap_info) } NSAPI_PUBLIC CertSearchFn_t -ldapu_get_cert_searchfn(const char *issuerDN) +ldapu_get_cert_searchfn(const CERTName *issuerDN) { LDAPUCertMapInfo_t *certmap_info = 0; @@ -1218,7 +1224,7 @@ ldapu_get_cert_searchfn(const char *issuerDN) } NSAPI_PUBLIC int -ldapu_set_cert_verifyfn(const char *issuerDN, +ldapu_set_cert_verifyfn(const CERTName *issuerDN, CertVerifyFn_t verifyfn) { LDAPUCertMapInfo_t *certmap_info; @@ -1251,7 +1257,7 @@ ldapu_get_cert_verifyfn_sub(LDAPUCertMapInfo_t *certmap_info) } NSAPI_PUBLIC CertVerifyFn_t -ldapu_get_cert_verifyfn(const char *issuerDN) +ldapu_get_cert_verifyfn(const CERTName *issuerDN) { LDAPUCertMapInfo_t *certmap_info = 0; @@ -1288,7 +1294,6 @@ static int ldapu_certinfo_copy (const LDAPUCertMapInfo_t *from, NSAPI_PUBLIC int ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage **res) { - char *issuerDN = 0; char *ldapDN = 0; char *filter = 0; LDAPUCertMapInfo_t *certmap_info; @@ -1308,14 +1313,14 @@ ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage * certmap_attrs[3] = 0; } - rv = ldapu_get_cert_issuer_dn(cert, &issuerDN); + CERTName *issuerDN = ldapu_get_cert_issuer_dn_as_CERTName(cert); + /* ^ don't need to free this; it will be freed with ^ the cert */ - if (rv != LDAPU_SUCCESS) + if (NULL == issuerDN) return LDAPU_ERR_NO_ISSUERDN_IN_CERT; /* don't free the certmap_info -- its a pointer to an internal structure */ rv = ldapu_issuer_certinfo(issuerDN, (void **)&certmap_info); - free(issuerDN); if (!certmap_info) certmap_info = default_certmap_info; @@ -1604,118 +1609,3 @@ ldapu_realloc(void *ptr, int size) { return realloc(ptr, size); } - -#define DNSEPARATOR(c) (c == ',' || c == ';') -#define SEPARATOR(c) (c == ',' || c == ';' || c == '+') -#define SPACE(c) (c == ' ' || c == '\n') -#define NEEDSESCAPE(c) (c == '\\' || c == '"') -#define B4TYPE 0 -#define INTYPE 1 -#define B4EQUAL 2 -#define B4VALUE 3 -#define INVALUE 4 -#define INQUOTEDVALUE 5 -#define B4SEPARATOR 6 - -static char * -ldapu_dn_normalize(char *dn) -{ - char *d, *s; - int state, gotesc; - - gotesc = 0; - state = B4TYPE; - for (d = s = dn; *s; s++) { - switch (state) { - case B4TYPE: - if (!SPACE(*s)) { - state = INTYPE; - *d++ = *s; - } - break; - case INTYPE: - if (*s == '=') { - state = B4VALUE; - *d++ = *s; - } else if (SPACE(*s)) { - state = B4EQUAL; - } else { - *d++ = *s; - } - break; - case B4EQUAL: - if (*s == '=') { - state = B4VALUE; - *d++ = *s; - } else if (!SPACE(*s)) { - /* not a valid dn - but what can we do here? */ - *d++ = *s; - } - break; - case B4VALUE: - if (*s == '"') { - state = INQUOTEDVALUE; - *d++ = *s; - } else if (!SPACE(*s)) { - state = INVALUE; - *d++ = *s; - } - break; - case INVALUE: - if (!gotesc && SEPARATOR(*s)) { - while (SPACE(*(d - 1))) - d--; - state = B4TYPE; - if (*s == '+') { - *d++ = *s; - } else { - *d++ = ','; - } - } else if (gotesc && !NEEDSESCAPE(*s) && - !SEPARATOR(*s)) { - *--d = *s; - d++; - } else { - *d++ = *s; - } - break; - case INQUOTEDVALUE: - if (!gotesc && *s == '"') { - state = B4SEPARATOR; - *d++ = *s; - } else if (gotesc && !NEEDSESCAPE(*s)) { - *--d = *s; - d++; - } else { - *d++ = *s; - } - break; - case B4SEPARATOR: - if (SEPARATOR(*s)) { - state = B4TYPE; - if (*s == '+') { - *d++ = *s; - } else { - *d++ = ','; - } - } - break; - default: - break; - } - if (*s == '\\') { - gotesc = 1; - } else { - gotesc = 0; - } - } - *d = '\0'; - - /* Trim trailing spaces */ - d--; - while (d >= dn && *d == ' ') { - *d-- = '\0'; - } - - return (dn); -} diff --git a/lib/ldaputil/examples/init.c b/lib/ldaputil/examples/init.c index 74db977..fd1edc9 100644 --- a/lib/ldaputil/examples/init.c +++ b/lib/ldaputil/examples/init.c @@ -15,12 +15,13 @@ #include <stdio.h> #include <string.h> #include <ctype.h> +#include <nss3/cert.h> #include "certmap.h" /* Public Certmap API */ #include "plugin.h" /* must define extern "C" functions */ NSAPI_PUBLIC int -plugin_init_fn(void *certmap_info, const char *issuerName, const char *issuerDN, const char *libname) +plugin_init_fn(void *certmap_info, const char *issuerName, const CERTName *issuerDN, const char *libname) { static int initialized = 0; int rv; -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (70bdd33 -> 5d611f1)
by git repository hosting 26 Nov '18

26 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a change to branch master in repository 389-ds-base. from 70bdd33 Ticket 49543 - fix certmap dn comparison add 5d611f1 Ticket 49814 - dscreate should handle selinux ports that are in a range No new revisions were added by this update. Summary of changes: src/lib389/lib389/utils.py | 5 +++++ 1 file changed, 5 insertions(+) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[389-ds-base] branch master updated (683bc57 -> 70bdd33)
by git repository hosting 26 Nov '18

26 Nov '18

This is an automated email from the git hooks/post-receive script. mreynolds pushed a change to branch master in repository 389-ds-base. from 683bc57 Ticket 49994 - comment out dev paths add 70bdd33 Ticket 49543 - fix certmap dn comparison No new revisions were added by this update. Summary of changes: include/ldaputil/certmap.h | 20 +++--- include/ldaputil/ldaputil.h | 2 +- lib/ldaputil/cert.c | 27 ++++++-- lib/ldaputil/certmap.c | 162 +++++++------------------------------------ lib/ldaputil/examples/init.c | 3 +- 5 files changed, 62 insertions(+), 152 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits November 2018