Repository navigation
eDirectory: Universal Password policy check + Legacy NDS userPassword option - #5
Merged
Merged
Conversation
… applies. eDirectory trees that only have NDS password rules reject RFC 3062 Password Modify. Read nspmPasswordPolicyDN (user, parent container, partition root, Login Policy) and, when nothing is assigned, default the change-password dialog to a userPassword replace over LDAPS. Password Modify failures 53, 19, and NMAS can retry that way. Existing NMAS error text is unchanged. Co-authored-by: Jerry Combs <jcombs@pointbluetech.com>
…ition is unseen. Offer a userPassword retry only after a conclusive lookup that found no Universal Password policy. Treat a missing local replica as unknown, keep Password Modify selected, and say so. Always mask userPassword and unicodePwd in the activity log, run password writes off the JavaFX thread, and re-check LDAPS after the connection is up. Co-authored-by: Jerry Combs <jcombs@pointbluetech.com>
The policy lookup read nspmPasswordPolicyDN on the user, container,
partition root and Login Policy. That attribute only shows explicit
assignments, so inherited policies were missed and missing or unreadable
attributes read as "no policy". Ask NMAS instead with Get password policy
information (2.16.840.1.113719.1.39.42.100.19), hand-encoded as
SEQUENCE { version 1, userDN }. The response is decoded as
{ version, nmasError, policyDN? }. Errors, unsupported servers and
unexpected layouts are UNKNOWN (with the raw bytes) and never default to
Legacy NDS.
The dialog is now an administrative reset for every directory type: no
current-password field or self-service mode. The legacy retry is offered
only when NMAS said no policy applies and the failure is not invalid
credentials, insufficient access, or an NMAS/NDS rights code. OK, Cancel
and window close are disabled while a write is in flight.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqCmx8MWAPFyiJVE7bLxyz
Matches Arbor and the decodeNmasCode map, which labels -224 as insufficient rights. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KqCmx8MWAPFyiJVE7bLxyz
Captured from ig4 for cn=test15,ou=users,o=data. The outer SEQUENCE length is long form (30 84 00 00 00 42); the decoder must keep accepting it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On eDirectory trees with only legacy NDS password rules (no Universal Password policy), RFC 3062 Password Modify is rejected by NMAS while a direct userPassword replace (as Apache Directory Studio does) works. Found on NAMAPP1 with Arbor 3.7.2; ArborJ parity.
mvn test: 175 passed. Two adversarial review rounds; remaining lows: Cancel enabled during an in-flight write. Not yet tested against a live eDirectory server.