From 70475cc2943a49842bbd4cfb43d39ba82e382603 Mon Sep 17 00:00:00 2001
From: downtownallday <downtownallday@gmail.com>
Date: Fri, 8 Apr 2022 10:05:34 -0400
Subject: [PATCH] Allow the nextcloud service account to be able to change user
 account passwords. This should be removed once Nextcloud Server iss 18406 is
 fixed.

---
 setup/ldap.sh               |  9 +++++++++
 tests/suites/ldap-access.sh | 29 +++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/setup/ldap.sh b/setup/ldap.sh
index 4621e793..6e1f32dc 100755
--- a/setup/ldap.sh
+++ b/setup/ldap.sh
@@ -579,6 +579,15 @@ apply_access_control() {
 	ldapmodify -Q -Y EXTERNAL -H ldapi:/// >/dev/null <<EOF
 dn: $cdn
 replace: olcAccess
+# the next line is for nextcloud to be able to change user account
+# passwords. remove it when nextcloud server issue #18406 is fixed
+olcAccess: to dn.subtree="${LDAP_USERS_BASE}" attrs=userPassword
+  by dn.exact="cn=management,${LDAP_SERVICES_BASE}" write
+  by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
+  by dn.exact="cn=nextcloud,${LDAP_SERVICES_BASE}" write
+  by self =wx
+  by anonymous auth
+  by * none
 olcAccess: to attrs=userPassword
   by dn.exact="cn=management,${LDAP_SERVICES_BASE}" write
   by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
diff --git a/tests/suites/ldap-access.sh b/tests/suites/ldap-access.sh
index 1c2393ff..b03149d1 100644
--- a/tests/suites/ldap-access.sh
+++ b/tests/suites/ldap-access.sh
@@ -19,6 +19,10 @@
 #	   no anonymous binds to root DSE
 #	   no anonymous binds to database
 #
+# Exception: the nextcloud service account is allowed to change user
+# passwords until this issue is fixed:
+#
+#    https://github.com/nextcloud/server/issues/18406
 
 
 test_user_change_password() {
@@ -113,6 +117,30 @@ test_user_access() {
 }
 
 
+test_nextcloud_service_access() {
+	# The nextcloud service account is allowed to change user
+	# passwords until issue #18406 is fixed
+	test_start "nextcloud-service-access"
+
+	# create regular user with password "alice"
+	local alice="alice@somedomain.com"	  
+	create_user "alice@somedomain.com" "alice"
+	local alice_dn="$ATTR_DN"
+
+	# allowed: update userPassword of a user account
+	assert_w_access "$alice_dn" "$LDAP_NEXTCLOUD_DN" "$LDAP_NEXTCLOUD_PASSWORD" write "userPassword=$(slappasswd_hash "alice-new")"
+
+	# not allowed: update userPassword of service account
+	assert_w_access "$LDAP_POSTFIX_DN" "$LDAP_NEXTCLOUD_DN" "$LDAP_NEXTCLOUD_PASSWORD" no-write "userPassword=$(slappasswd_hash "test-new")"
+	
+	# not allowed: update userPassword of own account
+	assert_w_access "$LDAP_NEXTCLOUD_DN" "$LDAP_NEXTCLOUD_DN" "$LDAP_NEXTCLOUD_PASSWORD" no-write "userPassword=$(slappasswd_hash "test-new")"
+	
+	delete_user "$alice"
+	
+	test_end
+}
+
 
 test_service_change_password() {
 	# service accounts should not be able to change other user's
@@ -249,6 +277,7 @@ test_user_change_password
 test_user_access
 test_service_change_password
 test_service_access
+test_nextcloud_service_access
 test_root_dse
 test_anon_bind