[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: How to obtain a 'version number' of an attributes



On Tue, 2010-05-25 at 05:11 +0200, masarati@aero.polimi.it wrote:
> > I've got a little challenge...
> >
> > there is an attribute in AD call msDS-KeyVersionNumber.  In AD this
> > operational attribute increments each time the unicodePwd attribute is
> > updated.  It is typically a small integer, being the number of times
> > that the password has ever been changed.
> >
> > In Samba4, we maintain this by looking into our replication metadata
> > (replPropertyMetaData), and returning a counter that is maintained
> > there.
> >
> > I could maintain this manually from Samba's side (this is what we did in
> > the past), but I wanted to first check if there was something already
> > stored that I could convert.
> 
> If I understand correctly what you're asking for, modifications of the
> unicodePwd attribute should be accompanied by modify:increment of a
> counter.  Something like:
> 
> dn: cn=someone
> changetype: modify
> replace: unicodePwd
> unicodePwd:: <some value>
> -
> 
> should be transformed into
> 
> dn: cn=someone
> changetype: modify
> replace: unicodePwd
> unicodePwd:: <some value>
> -
> increment: msDS-KeyVersionNumber
> msDS-KeyVersionNumber: 1
> -
> 
> This way, the modification is atomic.  As usual, this could be
> accomplished by stacking an overlay that intercepts modifications to
> specified attributes, like unicodePwd.
> 
> Can you formalize this a little bit more?

That's pretty much what I was looking for.  The exact semantics don't
matter too much, but this I need:
 - a 'small' monotonically increasing increasing integer
 - only increases for unicodePwd, not other updates.
 - always strictly related to the unicodePwd value it was incremented
for (as it will be used as an abstract idenifier, along with the
DN/samaccountname/etc to identify the secret unicodePwd value). 

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Cisco Inc.

Attachment: signature.asc
Description: This is a digitally signed message part