Ticket 49524 - Password policy: minimum token length fails

 when the token length is equal to attribute length

Bug Description:  The token checking breaks when the password is the
                  exact value of the entry attribute.

Fix Description:  Remove the "equal" part of the string comparisons.

https://pagure.io/389-ds-base/issue/49524

Reviewed by: firstyear & spichugi(Thanks!!)

dirsrvtests/tests/suites/password/pwdPolicy_token_test.py

@@ -0,0 +1,75 @@
+import logging
+import pytest
+import os
+import time
+import ldap
+from lib389._constants import *
+from lib389.idm.user import UserAccounts
+from lib389.topologies import topology_st as topo
+
+DEBUGGING = os.getenv("DEBUGGING", default=False)
+if DEBUGGING:
+    logging.getLogger(__name__).setLevel(logging.DEBUG)
+else:
+    logging.getLogger(__name__).setLevel(logging.INFO)
+log = logging.getLogger(__name__)
+
+USER_DN = 'uid=Test_user1,ou=People,dc=example,dc=com'
+TOKEN = 'test_user1'
+
+user_properties = {
+    'uid': 'Test_user1',
+    'cn': 'test_user1',
+    'sn': 'test_user1',
+    'uidNumber': '1001',
+    'gidNumber': '2001',
+    'userpassword': PASSWORD,
+    'description': 'userdesc',
+    'homeDirectory': '/home/{}'.format('test_user')}
+
+
+def pwd_setup(topo):
+    topo.standalone.config.replace_many(('passwordCheckSyntax', 'on'),
+                                        ('passwordMinLength', '4'),
+                                        ('passwordMinCategories', '1'))
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX)
+    return users.create(properties=user_properties)
+
+
+def test_token_lengths(topo):
+    """Test that password token length is enforced for various lengths including
+    the same length as the attribute being checked by the policy.
+
+    :id: dae9d916-2a03-4707-b454-9e901d295b13
+    :setup: Standalone instance
+    :steps:
+        1. Test token length rejects password of the same length as rdn value
+    :expectedresults:
+        1. Passwords are rejected
+    """
+    user = pwd_setup(topo)
+    for length in ['4', '6', '10']:
+        topo.standalone.simple_bind_s(DN_DM, PASSWORD)
+        topo.standalone.config.set('passwordMinTokenLength', length)
+        topo.standalone.simple_bind_s(USER_DN, PASSWORD)
+        time.sleep(1)
+
+        try:
+            passwd = TOKEN[:int(length)]
+            log.info("Testing password len {} token ({})".format(length, passwd))
+            user.replace('userpassword', passwd)
+            log.fatal('Password incorrectly allowed!')
+            assert False
+        except ldap.CONSTRAINT_VIOLATION as e:
+            log.info('Password correctly rejected: ' + str(e))
+        except ldap.LDAPError as e:
+            log.fatal('Unexpected failure ' + str(e))
+            assert False
+
+
+if __name__ == '__main__':
+    # Run isolated
+    # -s for DEBUG mode
+    CURRENT_FILE = os.path.realpath(__file__)
+    pytest.main("-s %s" % CURRENT_FILE)
+

ldap/servers/slapd/pw.c

@@ -1483,7 +1483,7 @@ check_trivial_words(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Value **vals, char *
             sp = slapi_ch_strdup(slapi_value_get_string(valp));
             ep = sp + strlen(sp);
             ep = ldap_utf8prevn(sp, ep, toklen);
-            if (!ep || (sp >= ep)) {
+            if (!ep || (sp > ep)) {
                 slapi_ch_free_string(&sp);
                 continue;
             }

ldap/servers/slapd/utf8.c

@@ -152,7 +152,7 @@ ldap_utf8prevn(char *s, char *from, int n)
     }
     for (; n > 0; --n) {
         prev = ldap_utf8prev(prev);
-        if ((prev <= s) && (n > 0)) {
+        if ((n > 0) && (prev < s)) {
             return NULL;
         }
     }