Alexander Bokovoy a9bcf531a6 ipa-pwd-extop: do not remove MagicRegen mod, replace it ... In 2012, ldbm backend in 389-ds started checking entry modification after running betxnpreop plugins by comparing a number of modifications before and after. If that number didn't change, it is considered that plugins didn't modify the list. ipa-pwd-extop actually removed and re-added modification to ipaNTHash if it contained 'MagicRegen' value. This did not work since commit https://pagure.io/389-ds-base/c/6c17ec56076d34540929acbcf2f3e65534060a43 but we were lucky nothing in FreeIPA code actually relied on that except some code paths in ipasam Samba passdb driver. However, Samba didn't reach the point where the code was triggered -- until now. With support to run Samba as a domain member in IPA domain, that code path is triggered for Kerberos service principals of domain members (cifs/client.example.test, ...) and NT hash extraction from Kerberos keys does not work. Fix ipa-pwd-extop to follow recommendations in https://pagure.io/389-ds-base/issue/387#comment-120145 and https://pagure.io/389-ds-base/issue/50369#comment-570696 Fixes: https://pagure.io/freeipa/issue/7953 Reviewed-By: Christian Heimes <cheimes@redhat.com>		2019-05-28 09:55:51 +03:00
..
__init__.py	pytest 3.x compatibility	2017-03-27 18:03:14 +02:00
cmdline.py	Add absolute_import future imports	2018-04-20 09:43:37 +02:00
test_cli.py	Test: add new tests for ipa-crlgen-manage	2019-03-14 09:39:55 +01:00
test_help.py	Address inconsistent-return-statements	2018-11-13 13:37:58 +01:00
test_ipagetkeytab.py	ipa-pwd-extop: do not remove MagicRegen mod, replace it	2019-05-28 09:55:51 +03:00