822420e2d3
Package openldap-config is added to config customized config file
of openldap.
Here is the customized change in slapd.service:
"
-After=syslog.target network-online.target
+Before=rsyncd.service
+After=network.target syslog-ng.target
-PIDFile=/var/run/openldap/slapd.pid
+PIDFile=/var/run/slapd.pid
-ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS
+ExecStart=/etc/init.d/openldap start
+ExecStop=/etc/init.d/openldap stop
+ExecReload=/etc/init.d/openldap restart
+RemainAfterExit=yes
"
Here is the customized change in slapd.sysconfig:
"
-#SLAPD_OPTIONS=""
+SLAPD_OPTIONS=""
"
Test:
Pass build and multi node deploy test. Confirmed related config
file is the same as before in deploy node.
Story: 2003768
Task: 26462
Depends-On: https://review.openstack.org/618440
Change-Id: I2559a8e43619449d6179ed913181052d653fa91d
Signed-off-by: slin14 <shuicheng.lin@intel.com>
44 lines
1.4 KiB
Diff
44 lines
1.4 KiB
Diff
From 9456b0eee753d9fd368347b6974a2f6f8d941d4f Mon Sep 17 00:00:00 2001
|
|
From: Kam Nasim <kam.nasim@windriver.com>
|
|
Date: Tue, 11 Apr 2017 17:23:03 -0400
|
|
Subject: [PATCH] rootdn should not bypass ppolicy
|
|
|
|
---
|
|
servers/slapd/overlays/ppolicy.c | 13 ++++++++++---
|
|
1 file changed, 10 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
|
|
index b446deb..fa79872 100644
|
|
--- a/servers/slapd/overlays/ppolicy.c
|
|
+++ b/servers/slapd/overlays/ppolicy.c
|
|
@@ -1904,8 +1904,9 @@ ppolicy_modify( Operation *op, SlapReply *rs )
|
|
}
|
|
for(p=tl; p; p=p->next, hsize++); /* count history size */
|
|
}
|
|
-
|
|
- if (be_isroot( op )) goto do_modify;
|
|
+
|
|
+ /* WRS UPDATE: Run ppolicy for all user password modify ops */
|
|
+ //if (be_isroot( op )) goto do_modify;
|
|
|
|
/* NOTE: according to draft-behera-ldap-password-policy
|
|
* pwdAllowUserChange == FALSE must only prevent pwd changes
|
|
@@ -2009,7 +2010,13 @@ ppolicy_modify( Operation *op, SlapReply *rs )
|
|
}
|
|
|
|
bv = newpw.bv_val ? &newpw : &addmod->sml_values[0];
|
|
- if (pp.pwdCheckQuality > 0) {
|
|
+
|
|
+ /* WRS UPDATE:
|
|
+ * If this is a rootDN op and this is the first password
|
|
+ * then bypass password policies as this is a new account
|
|
+ * creation
|
|
+ */
|
|
+ if (pp.pwdCheckQuality > 0 && !(be_isroot( op ) && !pa)) {
|
|
|
|
rc = check_password_quality( bv, &pp, &pErr, e, (char **)&txt );
|
|
if (rc != LDAP_SUCCESS) {
|
|
--
|
|
1.9.1
|
|
|