Uploaded image for project: 'Red Hat Directory Server'
  1. Red Hat Directory Server
  2. DIRSRV-60

RHDS11: passwordHistory is not updated with a pre-hashed password.

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Major Major
    • dirsrv-12.5
    • dirsrv-11.8
    • 389-ds-base
    • None
    • None
    • rhel-sst-idm-ds
    • 0
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • Bug Fix
    • Hide
      .{DS} now updates the password history for pre-hashed passwords as expected

      Previously, when you updated your password with a hashed value, the updated password hash was not listed in your password history. With this update, the issue has been fixed, and both hashed and non-hashed password updates are now listed in the password history.
      Show
      .{DS} now updates the password history for pre-hashed passwords as expected Previously, when you updated your password with a hashed value, the updated password hash was not listed in your password history. With this update, the issue has been fixed, and both hashed and non-hashed password updates are now listed in the password history.

      Description of problem:
      passwordHistory is not updated by with a pre-hashed password

      Version-Release number of selected component (if applicable):
      389-ds-base-1.4.3.37-7.module+el8dsrv+20631+5a3df0a9.x86_64

      How reproducible:
      always

      Steps to Reproduce:
      1. Add "uid=testuser,ou=people,dc=example,dc=com" with userPassword: <Password1>.
      2. Run the followins.

      dsconf ... pwpolicy set --pwdhistory on
dsconf ... config replace nsslapd-allow-hashed-passwords=on
ldapmodify -x -D "cn=Directory Manager" -w <Password> << 'EOF'
dn: dc=example,dc=com
changetype: modify
add: aci
aci: (targetattr="objectClass || description || uid || displayName || loginShell || uidNumber || gidNumber || gecos || homeDirectory || cn || memberOf || mail")(version 3.0; acl "Enable all read"; allow (read, search, compare)(userdn="ldap:///all");)
aci: (targetattr="userPassword")(version 3.0; acl "Enable self partial modify"; allow (write)(userdn="ldap:///self");)
EOF
pwdhash -s PBKDF2_SHA256 <Password2>
ldapmodify -x -D uid=testuser,ou=people,dc=example,dc=com -w <Password1>  << 'EOF'
dn: uid=testuser,ou=people,dc=example,dc=com
changetype: modify
replace: userpassword
userpassword: {PBKDF2_SHA256}...
EOF
ldapsearch ... uid=testuser passwordHistory

      Actual results:
      passwordHistory is not updated.

      Expected results:
      passwordHistory is updated.

      Additional info:

              idm-ds-dev-bugs IdM DS Dev
              rhn-support-msugaya Muneaki Sugaya
              IdM DS QE IdM DS QE
              Evgenia Martyniuk Evgenia Martyniuk
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: