389-ds-base

#47906 passwordhistory is not updated if password changed by admin user
Closed: wontfix Opened by gparente.

Closed: wontfix
Reopen Issue

This is a lateral effect of fix for

https://fedorahosted.org/389/ticket/47522
Password administrators should be able to violate password policy

Once password is succesfully modified, we have to update password history and passwordexpirationtime. First attribute is modified when:

  • config is set (passwordHistory: on in cn=config
  • old password is not NULL.

We set old password when checking password syntax but this control was skipped at fix for 47522.

Perhaps we consider a feature that when is admin that changes the password, the passwordhistory must not be updated. In this case, this ticket should be closed.

The testcase to reproduce this is exactly the same than:

https://fedorahosted.org/389/ticket/47905

But the bind dn should be "cn=directory manager"

I am proposing a fix in attachment.

I don't think password history should be updated if the password is changed by a password admin/root dn (these passwords are typically temporary and are not user defined), but the password expiration time should be.

Thanks Mark. So, this bug should be closed.

I found a different behavior than in former versions and I thought it might not be a feature.

Replying to [comment:3 gparente]:

Thanks Mark. So, this bug should be closed.

I found a different behavior than in former versions and I thought it might not be a feature.

If password expiration time is NOT being updated when rootdn or password admin updates a password, then this is a bug.

Thanks Mark for evaluation.
This bug was about passwordhistory. Closing it.
(If passwordexpirationtime were not updated, a new bug should be opened).

As additional info, if bind user is admin and a different user password is modified, it's considered a password reset.

passwordexpirationtime = 19700101000000Z

Metadata Update from @gparente:
- Issue set to the milestone: N/A

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/1237

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: Invalid)
Metadata
None
None
None
None
Normal
None
Community
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.