def set_global_policy(inst, basedn, log, args): log = log.getChild('set_global_policy') pwp_manager = PwPolicyManager(inst) attrs = _args_to_attrs(args, pwp_manager.arg_to_attr) pwp_manager.set_global_policy(attrs) print('Successfully updated global password policy')
def test_ticket49039(topo): """Test "password must change" verses "password min age". Min age should not block password update if the password was reset. """ # Setup SSL (for ldappasswd test) topo.standalone.enable_tls() # Configure password policy try: policy = PwPolicyManager(topo.standalone) policy.set_global_policy( properties={ 'nsslapd-pwpolicy-local': 'on', 'passwordMustChange': 'on', 'passwordExp': 'on', 'passwordMaxAge': '86400000', 'passwordMinAge': '8640000', 'passwordChange': 'on' }) except ldap.LDAPError as e: log.fatal('Failed to set password policy: ' + str(e)) # Add user, bind, and set password try: topo.standalone.add_s( Entry((USER_DN, { 'objectclass': 'top extensibleObject'.split(), 'uid': 'user1', 'userpassword': PASSWORD }))) except ldap.LDAPError as e: log.fatal('Failed to add user: error ' + e.args[0]['desc']) assert False # Reset password as RootDN try: topo.standalone.modify_s( USER_DN, [(ldap.MOD_REPLACE, 'userpassword', ensure_bytes(PASSWORD))]) except ldap.LDAPError as e: log.fatal('Failed to bind: error ' + e.args[0]['desc']) assert False time.sleep(1) # Reset password as user try: topo.standalone.simple_bind_s(USER_DN, PASSWORD) except ldap.LDAPError as e: log.fatal('Failed to bind: error ' + e.args[0]['desc']) assert False try: topo.standalone.modify_s( USER_DN, [(ldap.MOD_REPLACE, 'userpassword', ensure_bytes(PASSWORD))]) except ldap.LDAPError as e: log.fatal('Failed to change password: error ' + e.args[0]['desc']) assert False ################################### # Make sure ldappasswd also works ################################### # Reset password as RootDN try: topo.standalone.simple_bind_s(DN_DM, PASSWORD) except ldap.LDAPError as e: log.fatal('Failed to bind as rootdn: error ' + e.args[0]['desc']) assert False try: topo.standalone.modify_s( USER_DN, [(ldap.MOD_REPLACE, 'userpassword', ensure_bytes(PASSWORD))]) except ldap.LDAPError as e: log.fatal('Failed to bind: error ' + e.args[0]['desc']) assert False time.sleep(1) # Run ldappasswd as the User. os.environ["LDAPTLS_CACERTDIR"] = topo.standalone.get_cert_dir() cmd = ('ldappasswd' + ' -h ' + topo.standalone.host + ' -Z -p 38901 -D ' + USER_DN + ' -w password -a password -s password2 ' + USER_DN) os.system(cmd) time.sleep(1) try: topo.standalone.simple_bind_s(USER_DN, "password2") except ldap.LDAPError as e: log.fatal('Failed to bind: error ' + e.args[0]['desc']) assert False log.info('Test Passed')