389-ds-base

#51078 Add nsslapd-enable-upgrade-hash to the schema
Closed: wontfix by mreynolds. Opened by abbra.

Closed: wontfix
Reopen Issue

FreeIPA LDAP update code relies on the schema retrieval when deciding what to do with values of single-valued LDAP attributes. In the case attribute is single-valued and some value was present in the original entry for this attribute, it would use MOD_REPLACE. Otherwise, it uses MOD_DELETE + MOD_ADD.

Many attributes used in cn=config entries have no formal schema defined. Since by default an attribute is multi-valued, this fails the logic above for actual single-valued attributes, like nsslapd-enable-upgrade-hash. It means FreeIPA has to write special logic to handle just this attribute.

It would be good to expose schema for nsslapd-enable-upgrade-hash. We need to change its value to off in all FreeIPA installations because ipa-pwd-extop plugin prevents hashed passwords in updates due to a need to regenerate Kerberos hashes on a password change. It means upgrade of a password hash on LDAP bind will never work in FreeIPA.

Related bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1833266 and FreeIPA issue: https://pagure.io/freeipa/issue/8315
Related FreeIPA pull request: https://github.com/freeipa/freeipa/pull/4674

Metadata Update from @mreynolds:
- Issue assigned to mreynolds

Commit 6a0ece1e fixes this issue

Commit 6a0ece1 fixes this issue

f2e9961f1..632ed5692 389-ds-base-1.4.3 -> 389-ds-base-1.4.3

b4d2e3a30..e71dc2707 389-ds-base-1.4.2 -> 389-ds-base-1.4.2

d3c792baf..b6cb5b2e8 389-ds-base-1.4.1 -> 389-ds-base-1.4.1

Metadata Update from @mreynolds:
- Custom field origin adjusted to None
- Custom field reviewstatus adjusted to None
- Issue close_status updated to: None (was: Fixed)
- Issue priority set to: blocker
- Issue set to the milestone: 1.4.1
- Issue tagged with: Schema

Metadata Update from @tbordaz:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1833515

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/4131

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix
Metadata

Schema

None
None
Lowest
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.