SF Feature #1745642 - Add extended password modify support (RFC 3062) #8

New Issue

2015-09-25T04:04:17Z

deon commented

2015-09-25 04:04:17 +00:00

(Migrated from gitlab.dege.au)

When modifying userPassword attributes of a user entity, it would be nice if PLA used the extended password modify operation as described in RFC 3062. This enables additional password-related security features, such as requiring the existing password to be supplied, and enabling the password policy overlay provided by OpenLDAP.

I am asking because I am trying to deploy PLA 1.0.2 as a directory administration tool for our customer, but the sticking point is the fact that it does not support enforcement of password policy. I added the ppolicy overlay to our OpenLDAP directory, but it only takes effect if the RFC3062 extended operation is used to modify the userPassword attribute.

PLA uses a "normal" ldap-modify operation that bypasses the policy enforcement.

When modifying userPassword attributes of a user entity, it would be nice if PLA used the extended password modify operation as described in RFC 3062. This enables additional password-related security features, such as requiring the existing password to be supplied, and enabling the password policy overlay provided by OpenLDAP. I am asking because I am trying to deploy PLA 1.0.2 as a directory administration tool for our customer, but the sticking point is the fact that it does not support enforcement of password policy. I added the ppolicy overlay to our OpenLDAP directory, but it only takes effect if the RFC3062 extended operation is used to modify the userPassword attribute. PLA uses a "normal" ldap-modify operation that bypasses the policy enforcement.

deon commented

2015-09-25 04:23:06 +00:00

(Migrated from gitlab.dege.au)

I dont think the PHP API supports extended operations (yet)? If I am wrong and somebody can provide an example of how this is done in PHP, i'll aim to implement it in the next release...

deon commented

2020-08-23 02:36:09 +00:00

(Migrated from gitlab.dege.au)

mentioned in commit eca5c4ea9f

mentioned in commit eca5c4ea9f49a71c5ae5e414c9a73020b376a1d9

Sign in to join this conversation.

No Label

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: deon/phpldapadmin#8