Browse Source

Ticket #48183 - bind on db chained to AD returns err=32

Description by [email protected]: bind is doing a search for the entry
post bind, which fails because we don't enable password policy chaining
by default. I think in this case, we should not look up password policy,
because if the remote is AD or some other non-389 server, we can't use
the password policy information. We should instead rely on the remote
server to evaluate the password policy.

The commit 4fc53e1a63222d0ff67c30a59f2cff4b535f90a8 introduced the bug.
Ticket #47748 - Simultaneous adding a user and binding as the user could
                fail in the password policy check

https://fedorahosted.org/389/ticket/48183

Revewed by [email protected].
Noriko Hosoi 10 years ago
parent
commit
eb46e6f197
1 changed files with 2 additions and 1 deletions
  1. 2 1
      ldap/servers/slapd/bind.c

+ 2 - 1
ldap/servers/slapd/bind.c

@@ -777,7 +777,8 @@ do_bind( Slapi_PBlock *pb )
                          * was in be_bind.  Since be_bind returned SLAPI_BIND_SUCCESS,
                          * the entry is in the DS.  So, we need to retrieve it once more.
                          */
-                        if (!bind_target_entry) {
+                        if (!slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA) && 
+                            !bind_target_entry) {
                             bind_target_entry = get_entry(pb, slapi_sdn_get_ndn(sdn));
                             if (bind_target_entry) {
                                 myrc = slapi_check_account_lock(pb, bind_target_entry,