Return-Path: X-Original-To: apmail-directory-dev-archive@www.apache.org Delivered-To: apmail-directory-dev-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 9075318116 for ; Thu, 23 Jul 2015 17:07:25 +0000 (UTC) Received: (qmail 52686 invoked by uid 500); 23 Jul 2015 17:07:16 -0000 Delivered-To: apmail-directory-dev-archive@directory.apache.org Received: (qmail 52636 invoked by uid 500); 23 Jul 2015 17:07:16 -0000 Mailing-List: contact dev-help@directory.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "Apache Directory Developers List" Delivered-To: mailing list dev@directory.apache.org Received: (qmail 52626 invoked by uid 99); 23 Jul 2015 17:07:15 -0000 Received: from Unknown (HELO spamd3-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 23 Jul 2015 17:07:15 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd3-us-west.apache.org (ASF Mail Server at spamd3-us-west.apache.org) with ESMTP id 5DBB818D748 for ; Thu, 23 Jul 2015 17:07:15 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd3-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 2.901 X-Spam-Level: ** X-Spam-Status: No, score=2.901 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=3, URIBL_BLOCKED=0.001] autolearn=disabled Authentication-Results: spamd3-us-west.apache.org (amavisd-new); dkim=pass (1024-bit key) header.d=brummelhook.com Received: from mx1-eu-west.apache.org ([10.40.0.8]) by localhost (spamd3-us-west.apache.org [10.40.0.10]) (amavisd-new, port 10024) with ESMTP id kyNa8cWZddSm for ; Thu, 23 Jul 2015 17:07:04 +0000 (UTC) Received: from mo4-p00-ob.smtp.rzone.de (mo4-p00-ob.smtp.rzone.de [81.169.146.163]) by mx1-eu-west.apache.org (ASF Mail Server at mx1-eu-west.apache.org) with ESMTPS id 3F85720C4B for ; Thu, 23 Jul 2015 17:07:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1437671216; l=5210; s=domk; d=brummelhook.com; h=In-Reply-To:To:References:Date:Subject:Mime-Version:Content-Type: From; bh=j5ersexer0JOB9sE/Zd6owfEnbG7u72Z1yyBpCMiYBE=; b=bXCP30sbBBZFvoYQi31lR2kU/nUAXuqELH53swGFhHjb28C2JNDTimKcJnZ4PbE9ORa vjpt39lIDqSg64LxkTwFNTtKPlTzOnodxjb/SKdknx7Yv5J6G8Bp6H+0ijF86vPK4wbNw Ubu/QrBsEYcZTlDxyLNoMUSMRDdZtsCpj/I= X-RZG-AUTH: :IGMQfUG6NfdHJQMDoz/pPbE4/vLNN34OriRJpaYbtGTn9X+Lr8jmXNuzxHtvb52m9j5m8/U1mv2rDFw= X-RZG-CLASS-ID: mo00 Received: from [192.168.178.21] (p5DE9455A.dip0.t-ipconnect.de [93.233.69.90]) by smtp.strato.de (RZmta 37.8 DYNA|AUTH) with ESMTPSA id Q063b2r6NH6uP13 (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (curve secp521r1 with 521 ECDH bits, eq. 15360 bits RSA)) (Client did not present a certificate) for ; Thu, 23 Jul 2015 19:06:56 +0200 (CEST) From: Lothar Haeger Content-Type: multipart/alternative; boundary="Apple-Mail=_DDF397C4-6521-46C4-B1EB-AB75533434E3" Message-Id: <669E2579-E01D-4B0B-9013-6108871EFEE1@brummelhook.com> Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\)) Subject: Re: pwdHistory and admin Date: Thu, 23 Jul 2015 19:06:56 +0200 References: To: Apache Directory Developers List In-Reply-To: X-Mailer: Apple Mail (2.2102) --Apple-Mail=_DDF397C4-6521-46C4-B1EB-AB75533434E3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Sounds advisable to me, this is how Edirectory handles admin password = resets, btw.. Not just to prevent reuse of simple temp passwords, but = also to prevent=20 a) telling admins real previous passwords that could still be in use = elsewhere or b) giving hints on a user's password scheme which may enable the admin = to guess current/future passwords. For that reason only a user himself must be able to see the "already in = history" type of error on a password change. Admins should be able to = set any password for other accounts, as long as it adhere's to the = password complexity policy. Cheers, Lothar > Am 23.07.2015 um 18:47 schrieb Theisen, Lucas : >=20 > The password policy RFC = (http://tools.ietf.org/html/draft-behera-ldap-password-policy-10#section-8= .2.6 = ) is not very explicit, but it seems to me that an admin user = account should be exempt from the pwdHistory check. Its not uncommon = (though ill advised) for admins to supply simple temporary passwords, = and if history is long enough, they may have already done so with the = same password. This is causing failures for me. I can get around it be = manipulating the pwdHistory beforehand, but that seems like it should be = unnecessary. What do you think? Should we enable admin to avoid this = check? --Apple-Mail=_DDF397C4-6521-46C4-B1EB-AB75533434E3 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Sounds advisable to me, this is how Edirectory handles admin = password resets, btw.. Not just to prevent reuse of simple temp = passwords, but also to prevent 

a) telling admins real previous = passwords that could still be in use elsewhere or
b) = giving hints on a user's password scheme which may enable the admin to = guess current/future passwords.

For that reason only a = user himself must be able to see the "already in history" type of error = on a password change. Admins should be able to set any password for = other accounts, as long as it adhere's to the password complexity = policy.

Cheers, = Lothar

Am 23.07.2015 um 18:47 schrieb Theisen, Lucas = <ltheisen@mitre.org>:

The password policy  RFC = (http://tools.ietf.org/html/draft-behera-ldap-password-policy-10= #section-8.2.6) is not very = explicit, but it seems to me that an admin user account should be exempt = from the pwdHistory check.  Its not uncommon (though ill advised) = for admins to supply simple temporary passwords, and if history is long = enough, they may have already done so with the same password.  This = is causing failures for me.  I can get around it be manipulating = the pwdHistory beforehand, but that seems like it should be = unnecessary.  What do you think?  Should we enable admin to = avoid this check?

= --Apple-Mail=_DDF397C4-6521-46C4-B1EB-AB75533434E3--