freeipa

#9429 See if possible maxlife needs to be reduced
Closed: worksforme by rcritten. Opened by rcritten.

Closed: worksforme
Reopen Issue

Issue

Ticket https://pagure.io/freeipa/issue/3817 was resolved in 2013 in commit https://pagure.io/freeipa/c/f954f2d1b92db10113b766759897d66c57e1e3ab by setting a cap on maxlife in the password policy so it doesn't overflow.

Ten years later and a user has reported that using 20k resulted in authentication failures due to expired passwords. Seems like it is time to revisit.

Steps to Reproduce

  1. Install IPA
  2. Create some users passwords
  3. Authenticate to verify they are fine.
  4. Set global pwpolicy maxlife to 20000
  5. Authenticate again

This was reported against ipa-4.10.1-8.el9_2

Actual behavior

(what happens)

Expected behavior

(what do you expect to happen)

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

I can't reproduce this in IPA 4.9.12 (RHEL 8.9) nor IPA 4.11.0 (RHEL 9.4). My steps were:

  • ipa-server-install ...
  • kinit admin
  • ipa pwpolicy-mod --maxlife 20000 --minlife 0
  • echo password | ipa user-add tuser --first tim --last user --password
  • kinit tuser (to set expiration date)
  • kinit tuser (to validate auth)
  • ldapsearch -x -D uid=tuser,cn=users,cn=accounts,dc=example,dc=test -W -b dc=example,dc=test uid=tuser

THis resulted in a password expiration date of 20790310164554Z and from my simple testing it is working fine.

Closing as invalid.

Metadata Update from @rcritten:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.