[phpldapadmin] [ phpldapadmin-Feature Requests-2009667 ] Dealing with password policy

"SourceForge.net" <[email protected]>
Newsgroups gmane.comp.ldap.davedap
Message-ID <[email protected]> 
Feature Requests item #2009667, was opened at 2008-07-03 18:02
Message generated for change (Comment added) made by chipitsine
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498549&aid=2009667&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: Future
Status: Open
Priority: 5
Private: No
Submitted By: Clement OUDOT (clement_oudot)
Assigned to: Nobody/Anonymous (nobody)
Summary: Dealing with password policy

Initial Comment:
Hello there,

I think PLA is great administrative tool.

I often use the slapo-policy in OpenLDAP and think it would be a good functionnality to be able to manage this policy in PLA.

But this functionnality rely on LDAP controls, and I think PHP-LDAP can't manage it, is it true ?

If I'm false (I hope so), it can be interesting to have a lock/unlock button when viewing a user entry, and other administrative action like reseting the password history, and so on...

Have some of you already work on this?

Clement.

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-02-23 19:56

Message:
so, let us correct php_get_option ? ))

----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-02-23 19:56

Message:
Sorry,

I only understand that you face a bug when using ldap_get_option and that
you propose to use ldap_parse_result. Have you tested this solution? You do
not write if it works.



----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-02-23 19:51

Message:
please read what I wrote and find all answers there

----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-02-23 19:46

Message:
Hello,

it seems you use correctly the control and but that PHP does not provide
correct tools to manage the response (due to bugs as I see).

You are certainly right when saying we should first correct PHP bugs
before implementing this feature.

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-02-23 19:33

Message:
sorry for the late response, I had to move to another town due to crisis.

I did some investigation and what I've found:

1) according to the sniffer (wireshark) proper effect is achived in the
following case

$ppolicy = array( array('oid' => '1.3.6.1.4.1.42.2.27.8.5.1') );
ldap_set_option($ds, LDAP_OPT_SERVER_CONTROLS,$ppolicy);


please note, that is SERVER control, not Client.
anyway, sniffer shows everything (request and response) is set properly:

http://photo.rediska.ru/bindrequest.png
http://photo.rediska.ru/bindresponse.png


2) the only problem is how to fetch result seen on bindresponse ....

a) it seems ldap_get_option is broken


  if(!ldap_get_option($ds, LDAP_OPT_SERVER_CONTROLS, &$serverctrls)){
    echo "no options set";
    echo "<br />"; print_r($serverctrls); echo "<br />";
  }else{
    echo "options set";
   echo "<br />"; print_r($serverctrls); echo "<br />";
  }


I'm constantly getting "no options set" and empty print_r();

http://bugs.php.net/bug.php?id=42281

it's not yet closed (should we close that bug first ?)

b) another approach is to go to ldap_parse_results, for instance


http://bugs.php.net/bug.php?id=42281

but note, they are using patched version of php. which gives extra
argument to ldap_parse_results.




----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-01-12 18:00

Message:
Hello,

thanks for testing. Now to run password policy inside PHP code, you have
to use LDAP CONTROL, which is a specific extension, that you can add to a
bind, search, or modify operation.

In real life: use ldap_set_option() with LDAP_OPT_CLIENT_CONTROLS.

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-07 23:27

Message:
I finally got it working ...

I locked my account, so

jane# ldapsearch -D "cn=ilia,ou=Users,dc=poka,dc=net" -x -w xxx -b
"dc=poka,dc=net"
ldap_bind: Invalid credentials (49)
jane# ldapsearch -D "cn=ilia,ou=Users,dc=poka,dc=net" -x -w xxx -b
"dc=poka,dc=net" -e ppolicy
ldap_bind: Invalid credentials (49); Account locked
jane# 


the only question is: how to pass "-e ppolicy" to php ?

<?php

$server='127.0.0.1';
$admin='cn=ilia,ou=Users,dc=poka,dc=net';
$passwd='xxx';

$ds=ldap_connect($server);  // assuming the LDAP server is on this host
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);


if ($ds) {
    // bind with appropriate dn to give update access
    $r=ldap_bind($ds, $admin, $passwd);
    if(!$r){
           echo 'number is : '.ldap_errno($ds).'<br>';
           echo ldap_error($ds).'<br>';
           die("ldap_bind failed<br>");
    }

    echo "ldap_bind success";
    ldap_close($ds);
} 
?>


shows only:

number is : 49
Invalid credentials
ldap_bind failed


it knows nothing about "-e ppolicy"

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-07 08:06

Message:
neither it worked when I added

pwdAccountLockedTime=20070107025706Z

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-07 07:59

Message:
how do you usually lock accounts ?

I added pwdAccountLockedTime=000001010000Z as draft specifies, but
OpenLDAP seems not to honor it.

----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-01-06 15:27

Message:

> any LDAP server shows that attribute ?

Maybe SUN/Netcape and ApacheDS

> that's good idea.
> it even doesn't require PLA to know about ppolicy.
> I'll try to code it soon

Yes that the advantage to manage ppolicy directly in the LDAP server.

> for instance, if I login as "Manager", why should I care about password
> policy ?
> as regular user - yes, I should ))

Directory Manager (rootdn) is not affected by ppolicy. Only users are
submitted to it (and you can configure ppolicy to affect only some users,
or configure different policies for different users).


> it is very similar to what is done via templates.
> ppolicy uses certain objectClass, so editing is not that different from
>any other editing ?

Yes, for the entries of objectClass pwdPolicy, it is just a template. But
to manage operationnal attributes from users entries, maybe we have to
program functions like "lock the account", "unlock", "empty password
history", etc.

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-06 14:48

Message:
> the control OID of password policy is 1.3.6.1.4.1.42.2.27.8.5.1 (as
> written in the draft), and this OID can appear in the RootDSE. But if I

any LDAP server shows that attribute ?

> remember well, OpenLDAP does not publish this OID in the RootDSE
because
> it's a draft and not a RFC. So maybe we have to force the use of ppolicy
in
> PLA config.

there's still an opportunity to catch it via its behaviour.
if it behaves like ppolicy, so we think it's ppolicy ))

> Then, what can do PLA with ppolicy? I see 3 things:
> - Use ppolicy when doing authentication of PLA users (for example
display
> "account locked" if the user logs in and the authentication failed
because
> the account is locked) - Use of ppolicy control needed

that's good idea.
it even doesn't require PLA to know about ppolicy.
I'll try to code it soon

> - Use ppolicy when doing a password change (for example display
"password
> too short" if the submitted password is not long enough) - Use of
ppolicy
> control needed

it's questionable in turn.

for instance, if I login as "Manager", why should I care about password
policy ?
as regular user - yes, I should ))

if we can handle Manager separately, I see no problem with this as well.
You change your password, PLA catches an error and reports it.
like "ppolicy says password is not good enough because..."

> - View and edit entries operationnal attributes linked to ppolicy, as
the
> password history, the grace time, etc. - Use of ppolicy control not
needed
> - View and edit ppolicy configuration (OpenLDAP only) by modifiying the
> LDAP entries with objectClass=pwdPolicy - Use of ppolicy control not
needed


it is very similar to what is done via templates.
ppolicy uses certain objectClass, so editing is not that different from
any other editing ?


----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-01-06 14:00

Message:
Hello,

the control OID of password policy is 1.3.6.1.4.1.42.2.27.8.5.1 (as
written in the draft), and this OID can appear in the RootDSE. But if I
remember well, OpenLDAP does not publish this OID in the RootDSE because
it's a draft and not a RFC. So maybe we have to force the use of ppolicy in
PLA config.

Then, what can do PLA with ppolicy? I see 3 things:
- Use ppolicy when doing authentication of PLA users (for example display
"account locked" if the user logs in and the authentication failed because
the account is locked) - Use of ppolicy control needed
- Use ppolicy when doing a password change (for example display "password
too short" if the submitted password is not long enough) - Use of ppolicy
control needed
- View and edit entries operationnal attributes linked to ppolicy, as the
password history, the grace time, etc. - Use of ppolicy control not needed
- View and edit ppolicy configuration (OpenLDAP only) by modifiying the
LDAP entries with objectClass=pwdPolicy - Use of ppolicy control not needed

Clément.


----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-06 00:43

Message:
hmm, according to http://www.openldap.org/foundation/oid-delegate.txt
there's no OID related to ppolicy

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-06 00:34

Message:
rootDSE contains some information on supported features and extensions

can You please do the following query on your LDAP server(s) ?

ldapsearch -b "" -s base +


another way to view that information --> phpLDAPadmin --> server info

in my case I see many things there, except ppolicy

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-05 20:31

Message:
hmm, I think search with (objectClass=pwdPolicy) is not very good idea.
I read that draft and didn't find a way how can one determine whether
directory implements policy or not.

any suggestion ?

btw, how do you see phpLDAPadmin role in that ? any design thing, picture
or something ?

----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-01-05 17:28

Message:
The RFC draft is here:
http://www.faqs.org/ftp/pub/internet-drafts/draft-behera-ldap-password-policy-09.txt

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-05 16:22

Message:
is ppolicy defined by some RFC ? so, that many LDAP servers support it in
the same way ?

----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-01-05 13:32

Message:
Hello,

the goal is not to test if we are with OpenLDAP or not, but to test if the
ppolicy control is available. All directories providing this control can
manage password policy.

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-04 12:54

Message:
how can you make sure you are dealing with OpenLDAP ?

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498549&aid=2009667&group_id=61828

------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.