external/mailinabox
1
0
Fork 0
mirror of https://github.com/mail-in-a-box/mailinabox.git synced 2026-03-12 17:07:23 +01:00
Code Issues Releases Wiki Activity

Allow the nextcloud service account to be able to change user account passwords.

Browse Source 
This should be removed once Nextcloud Server iss 18406 is fixed.
This commit is contained in:
downtownallday
2022-04-08 10:05:34 -04:00
parent 98f4e5b2fc
commit 70475cc294
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
tests/suites/ldap-access.sh
View File

@@ -19,6 +19,10 @@
# no anonymous binds to root DSE
# no anonymous binds to database
#
# Exception: the nextcloud service account is allowed to change user
# passwords until this issue is fixed:
#
# https://github.com/nextcloud/server/issues/18406
test_user_change_password() {
@@ -113,6 +117,30 @@ test_user_access() {
}
test_nextcloud_service_access() {
# The nextcloud service account is allowed to change user
# passwords until issue #18406 is fixed
test_start "nextcloud-service-access"
# create regular user with password "alice"
local alice="alice@somedomain.com"
create_user "alice@somedomain.com" "alice"
local alice_dn="$ATTR_DN"
# allowed: update userPassword of a user account
assert_w_access "$alice_dn" "$LDAP_NEXTCLOUD_DN" "$LDAP_NEXTCLOUD_PASSWORD" write "userPassword=$(slappasswd_hash "alice-new")"
# not allowed: update userPassword of service account
assert_w_access "$LDAP_POSTFIX_DN" "$LDAP_NEXTCLOUD_DN" "$LDAP_NEXTCLOUD_PASSWORD" no-write "userPassword=$(slappasswd_hash "test-new")"
# not allowed: update userPassword of own account
assert_w_access "$LDAP_NEXTCLOUD_DN" "$LDAP_NEXTCLOUD_DN" "$LDAP_NEXTCLOUD_PASSWORD" no-write "userPassword=$(slappasswd_hash "test-new")"
delete_user "$alice"
test_end
}
test_service_change_password() {
# service accounts should not be able to change other user's
@@ -249,6 +277,7 @@ test_user_change_password
test_user_access
test_service_change_password
test_service_access
test_nextcloud_service_access
test_root_dse
test_anon_bind