From: Ondřej Kuzník <ondra@mistotebe.net>
Date: Thu, 31 Jul 2025 17:57:33 +0000 (+0100)
Subject: ITS#10254 Do not trigger pwdReset when rehashing
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0734bc337379b940f7bc8e764724711d849abd6a;p=thirdparty%2Fopenldap.git

ITS#10254 Do not trigger pwdReset when rehashing
---

diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index a0a17d8019..b5498dd62f 100644
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -3111,6 +3111,25 @@ ppolicy_bind_response( Operation *op, SlapReply *rs )
 							"rehashing password for user %s failed: %s\n",
 							op->o_req_dn.bv_val, txt );
 				} else {
+					/*
+					 * Rehashing is a password change by an administrator, but
+					 * we don't want it to change pwdReset state.
+					 */
+					if ( ppb->pp.pwdMustChange ) {
+						/*
+						 * Earlier we chose this branch because the reset state
+						 * is not TRUE.
+						 */
+						m = ch_calloc( sizeof(Modifications), 1 );
+						m->sml_op = LDAP_MOD_REPLACE;
+						m->sml_flags = SLAP_MOD_INTERNAL;
+						m->sml_type = ad_pwdReset->ad_cname;
+						m->sml_desc = ad_pwdReset;
+						m->sml_next = mod;
+						m->sml_numvals = 0;
+						mod = m;
+					}
+
 					m = ch_calloc( sizeof(Modifications), 1 );
 					m->sml_op = LDAP_MOD_ADD;
 					m->sml_flags = SLAP_MOD_INTERNAL;
diff --git a/tests/data/ppolicy.ldif b/tests/data/ppolicy.ldif
index a13fe9b134..ef779ea94a 100644
--- a/tests/data/ppolicy.ldif
+++ b/tests/data/ppolicy.ldif
@@ -106,6 +106,7 @@ objectClass: pwdPolicy
 objectClass: pwdHashingPolicy
 cn: Hashing Policy
 pwdAttribute: 2.5.4.35
+pwdMustChange: TRUE
 pwdDefaultHash: {SHA}
 pwdRehashOnBind: TRUE