ITS#4134 delete pwdFailureTime on password reset

diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index 0d87840a166290f1b081f1b0f791b3d658088c9b..dcc1ddef459aace639f6464aaa2d299c574634be 100644 (file)
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -1179,11 +1179,12 @@ ppolicy_modify( Operation *op, SlapReply *rs )
         */
        if ( be_shadow_update( op )) {
                Modifications **prev;
-               int got_del_grace = 0, got_del_lock = 0, got_pw = 0;
-               Attribute *a_grace, *a_lock;
+               int got_del_grace = 0, got_del_lock = 0, got_pw = 0, got_del_fail = 0;
+               Attribute *a_grace, *a_lock, *a_fail;
 
                a_grace = attr_find( e->e_attrs, ad_pwdGraceUseTime );
                a_lock = attr_find( e->e_attrs, ad_pwdAccountLockedTime );
+               a_fail = attr_find( e->e_attrs, ad_pwdFailureTime );
 
                for( prev = &op->oq_modify.rs_modlist, ml = *prev; ml;
                        prev = &ml->sml_next, ml = *prev ) {
@@ -1206,6 +1207,11 @@ ppolicy_modify( Operation *op, SlapReply *rs )
                                        got_del_lock = 1;
                                        if ( !a_lock )
                                                drop = 1;
+                               } else
+                               if ( ml->sml_desc == ad_pwdFailureTime ) {
+                                       got_del_fail = 1;
+                                       if ( !a_fail )
+                                               drop = 1;
                                }
                                if ( drop ) {
                                        *prev = ml->sml_next;
@@ -1215,8 +1221,8 @@ ppolicy_modify( Operation *op, SlapReply *rs )
                        }
                }
 
-               /* If we're resetting the password, make sure grace and accountlock
-                * also get removed.
+               /* If we're resetting the password, make sure grace, accountlock,
+                * and failure also get removed.
                 */
                if ( got_pw ) {
                        if ( a_grace && !got_del_grace ) {
@@ -1242,6 +1248,17 @@ ppolicy_modify( Operation *op, SlapReply *rs )
                                ml->sml_next = NULL;
                                *prev = ml;
                        }
+                       if ( a_fail && !got_del_fail ) {
+                               ml = (Modifications *) ch_malloc( sizeof( Modifications ) );
+                               ml->sml_op = LDAP_MOD_DELETE;
+                               ml->sml_flags = SLAP_MOD_INTERNAL;
+                               ml->sml_type.bv_val = NULL;
+                               ml->sml_desc = ad_pwdFailureTime;
+                               ml->sml_values = NULL;
+                               ml->sml_nvalues = NULL;
+                               ml->sml_next = NULL;
+                               *prev = ml;
+                       }
                }
                op->o_bd->bd_info = (BackendInfo *)on->on_info;
                be_entry_release_r( op, e );