[Freeipa-devel] [freeipa PR#2584][opened] ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager

[tiran]

   URL: https://github.com/freeipa/freeipa/pull/2584
Author: tiran
 Title: #2584: ipa-pwd-extop: don't check password policy for non-Kerberos account set
by DM or a passsync manager
Action: opened

PR body:
"""
The PR was originally PR @abbra's PR https://github.com/freeipa/freeipa/pull/2106.
PR-CI was broken for that PR. I also squashed some intermediate commits.

## Original PR message

Password changes performed by cn=Directory Manager are excluded from
password policy checks according to [1]. This is correctly handled by
ipa-pwd-extop in case of a normal Kerberos principal in IPA. However,
non-kerberos accounts were not excluded from the check.

As result, password updates for PKI CA admin account in o=ipaca were
failing if a password policy does not allow a password reuse. We are
re-setting the password for PKI CA admin in ipa-replica-prepare in case
the original directory manager's password was updated since creation of
`cacert.p12`.

Do password policy check for non-Kerberos accounts only if it was set by
a regular user or admin. Changes performed by a cn=Directory Manager and
passsync managers should be excluded from the policy check.

Fixes: https://pagure.io/freeipa/issue/7181
Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com&gt;

[1]
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2584/head:pr2584
git checkout pr2584