From dcc6f13a58a66b909bc298fe4b37c5f30fa1be4a Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Fri, 8 Mar 2013 13:01:45 +0100 Subject: Use new 389-ds-base cleartext password API The way how unhashed password is stored in the entry was changed in 389-ds-base-1.3.0, it is now stored in an entry extension rather than in a magic attribute unhashed#user#password. New API using an entry extension was introduced. ipa-pwd-extop should take advantage of the new API as the old one will be removed in 389-ds-base-1.3.1. https://fedorahosted.org/freeipa/ticket/3439 --- .../ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) (limited to 'daemons/ipa-slapi-plugins') diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c index 3b512a474..0318cecdc 100644 --- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c +++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_prepost.c @@ -211,13 +211,19 @@ static int ipapwd_pre_add(Slapi_PBlock *pb) slapi_ch_free_string(&userpw); userpw = tmp; } else if (slapi_is_encoded(userpw)) { - /* check if we have access to the unhashed user password */ - char *userpw_clear = - slapi_entry_attr_get_charptr(e, "unhashed#user#password"); + const char *userpw_clear = NULL; + Slapi_Value **pwvals = NULL; + + /* Try to get clear password from an entry extension. + * This function does not return a copy of the values, + * no need to free them. */ + rc = slapi_pw_get_entry_ext(e, &pwvals); + if (LDAP_SUCCESS == rc) { + userpw_clear = slapi_value_get_string(pwvals[0]); + } - /* unhashed#user#password doesn't always contain the clear text - * password, therefore we need to check if its value isn't the same - * as userPassword to make sure */ + /* Fail if we did not get a real clear text password from + * the extension. This will happen if the password is hashed. */ if (!userpw_clear || (0 == strcmp(userpw, userpw_clear))) { rc = LDAP_CONSTRAINT_VIOLATION; slapi_ch_free_string(&userpw); @@ -225,8 +231,6 @@ static int ipapwd_pre_add(Slapi_PBlock *pb) userpw = slapi_ch_strdup(userpw_clear); } - slapi_ch_free_string(&userpw_clear); - if (rc != LDAP_SUCCESS) { /* we don't have access to the clear text password; * let it slide if migration is enabled, but don't -- cgit