Check password in history of old passwords

[coudot]

Currently, we check the password on the current value (by doing an LDAP BIND)

We would like to be able to browse password history and check the password on this history.

Use case : the password of the user has changed but the user forgot it and use an old password. We can verify that this old password is really a previous password of the user.

It would be possible only with a standard LDAP directory that is compatible with password policy (pwdHistory)

[coudot]

Prerequisite : #118

[abpai94]

Checking if the user is anonymous or AUTH-USER can be used as a flag to request the users's previous password before making a change. If the user is anonymous the userDN rather than the bindDN is used in order to trigger the following message:

ldap_modify: Constraint violation (19)
additional info: Password is in history of old passwords

Source: link

This attribute is used to specify the maximum number of used passwords that will be stored in the pwdHistory attribute. If the pwdInHistory attribute is not present, or if its value is zero (0), used passwords will not be stored in pwdHistory and thus any previously-used password may be reused. No history checking occurs if the password is being modified by the rootdn, although the password is saved in the history.

[coudot]

This is not what is wanted here.

The big plan is:

• Update the code only for the check password feature
• Read the password history attribute (pwdHistory in OpenLDAP)
• For each value of password history, get the hashed password (with the salt if needed)
• Do the same hash function (with same salt if needed) on the checked password
• If both values match, then it means the password is in the password history

[coudot]

We need to use the ltb-common Password module to check the password hashes: https://github.com/ltb-project/ltb-common/blob/main/src/Ltb/Password.php

[davidcoutadeur]

Hello,

@abpai94 I think this issue was assigned to me at the beginning. Did you have a special reason for working on this?

I have no problem for you to work on this issue, but:

1. please take care to communicate before auto-assigning (in order for us to share and plan the tasks the best we can)
2. I had a precise idea of how to deal with this issue, so if you have to work on it, I could at least give you the implementation details.

David

[abpai94]

Hey @davidcoutadeur

Apologies for not informing you before picking it up. I found the topic interesting so I picked it up. In the future I will make sure to mention to the previously assigned person before picking up their ticket.

As you can see in the pull request I went down a very specific rabbit hole which proved to be incorrect. I have spoken to @coudot who provided me more context which I will implement. So any more information you have about implementations would be helpful.

Abhishek

[abpai94]

@coudot The issue has been completed. It requires the ltb-project/ltb-common#31 to be merged and the new version incremented for this feature to work.

[davidcoutadeur]

Done in #162

See also 1532815 and 30e4e06