[PATCH] Patch to implement AD password lockout in Samba's AD DC
Stefan (metze) Metzmacher
metze at samba.org
Mon Mar 24 14:10:05 MDT 2014
Am 23.03.2014 01:06, schrieb Andrew Bartlett:
> On Sat, 2014-03-22 at 23:24 +1300, Andrew Bartlett wrote:
>> On Fri, 2014-03-21 at 17:16 +0100, Stefan (metze) Metzmacher wrote:
>>> Hi Andrew,
>>>>> I've now tested with Windows and Samba and have a patch series at:
>>>> Updated patches have been pushed!
>>>> Hopefully we are getting closer.
>>> I merged this together with my branch
>>> and the result can be found at
>>> Please have a look at
>>> which I reworked at bit. They require your sign-off to be refreshed.
>> These look good, and much clearer. Signed-off-by: Andrew Bartlett
>> <abartlet at samba.org>
>>> I need to review and run the tests from
>>> again in order to decide about
>> I think this is now covered.
> Do be clearer, the in the password_lockout.py test, we use SAMR to
> unlock the account, and in that instance the test clearly shows that
> values are reset to 0.
>> badPwdCount is not reset on a successful LDAP password change. The
>> tests of samr code I've just done show that SAMR password changes also
>> don't change that. I don't currently have good enough tests for what
>> happens to the lockoutTime, but to get this far it must not be relevant
>> (ie in the past), and for LDAP the test I've just added to
>> password_lockout.py shows this patch should be dropped, it doesn't
>> actually update lockoutTime.
>>> I've started to look at the tests, but I'm not done yet...
> BTW, with the patches I sent we pass our own 'make test TESTS=passwords'
> on my branch. Naturally the patches need to be squashed into the
> matching commits, but I think we are finally getting very close.
I've updated the password_lockout.py and verified that the current
I think we need to have a trigger in an ldb module that sets badPwdCount = 0
is lockoutTime is set to 0.
This matches [MS-SAMR] 220.127.116.11.3 lockoutTime
The SAMR reset of ACB_AUTOLOCK has only impact if
the account is locked out. I think it only sets lockoutTime = 0.
I have the feeling that somehow
is also correct, but I don't know how exactly.
I just found
userAccountControl = dsdb.UF_NORMAL_ACCOUNT|dsdb.UF_LOCKOUT
doesn't reset, but
userAccountControl = dsdb.UF_NORMAL_ACCOUNT
does reset lockoutTime = 0 and badPwdCount = 0.
I haven't changed the tests yet, but I've tested it locally.
More information about the samba-technical