ldap-rest 0.20.2 → 0.21.0

package/dist/src/plugins/ldap/passwordPolicy.d.ts

@@ -1,14 +1,3 @@
-/**
- * Password Policy plugin - Administration API for OpenLDAP ppolicy
- *
- * Provides REST endpoints to:
- * - Query password status (expiration, lockout, etc.)
- * - Unlock locked accounts
- * - List expiring passwords and locked accounts
- * - Validate password complexity (optional)
- *
- * @author Xavier Guimard <xguimard@linagora.com>
- */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 /**
@@ -133,6 +122,60 @@ import DmPlugin, { type Role } from '../../abstract/plugin';
  *       type: integer
  *       description: Number of grace logins already consumed.
  *       example: 0
+ *     policy:
+ *       type: string
+ *       nullable: true
+ *       description: |
+ *         DN of the policy the status was computed with: the one the
+ *         account's `pwdPolicySubentry` names, else the default one.
+ *       example: cn=default,ou=policies,dc=example,dc=com
+ * PasswordPolicyEntry:
+ *   type: object
+ *   description: |
+ *     A password policy entry. Only the attributes the entry holds are
+ *     served; durations are in **seconds**. `pwdAttribute` and
+ *     `pwdCheckModule` are read-only.
+ *   required: [dn, cn, isDefault]
+ *   properties:
+ *     dn: { type: string, example: 'cn=default,ou=policies,dc=example,dc=com' }
+ *     cn: { type: string, example: default }
+ *     isDefault:
+ *       type: boolean
+ *       description: Whether this is the policy accounts without `pwdPolicySubentry` get.
+ *     pwdAttribute: { type: string, example: userPassword }
+ *     pwdMinAge: { type: integer }
+ *     pwdMaxAge: { type: integer, example: 7776000 }
+ *     pwdInHistory: { type: integer, example: 5 }
+ *     pwdCheckQuality: { type: integer, minimum: 0, maximum: 2 }
+ *     pwdMinLength: { type: integer, example: 12 }
+ *     pwdMaxLength: { type: integer }
+ *     pwdExpireWarning: { type: integer }
+ *     pwdGraceAuthNLimit: { type: integer }
+ *     pwdGraceExpiry: { type: integer }
+ *     pwdLockout: { type: boolean }
+ *     pwdLockoutDuration: { type: integer }
+ *     pwdMaxFailure: { type: integer }
+ *     pwdFailureCountInterval: { type: integer }
+ *     pwdMustChange: { type: boolean }
+ *     pwdAllowUserChange: { type: boolean }
+ *     pwdSafeModify: { type: boolean }
+ *     pwdMinDelay: { type: integer }
+ *     pwdMaxDelay: { type: integer }
+ *     pwdMaxIdle: { type: integer }
+ *     pwdMaxRecordedFailure: { type: integer }
+ *     pwdCheckModule: { type: string }
+ *     pwdCheckModuleArg:
+ *       type: string
+ *       description: Configuration of the quality-check module, usually several lines.
+ *     pwdUseCheckModule: { type: boolean }
+ * PasswordPolicyChanges:
+ *   type: object
+ *   description: |
+ *     Attributes to set, by name as in `PasswordPolicyEntry`. `null` removes
+ *     the attribute. On `PATCH`, `dn`, `cn`, `isDefault` and the read-only
+ *     attributes are accepted only with the value the entry already has.
+ *   additionalProperties: true
+ *   example: { pwdMaxAge: 31536000, pwdLockout: true, pwdExpireWarning: null }
  * ExpiringAccount:
  *   type: object
  *   description: User whose password is expiring within the warning window.
@@ -193,18 +236,22 @@ export default class PasswordPolicy extends DmPlugin {
     name: string;
     roles: Role[];
     private policyCache;
-    private policyCacheTime;
+    private discoveredDefault;
+    private warnedAmbiguousDefault;
+    private warnedMissingBase;
+    private lastDefaultPolicy;
     private readonly POLICY_CACHE_TTL;
     api(app: Express): void;
     /**
      * Get password status for a user
      *
-     * Every lookup of this plugin carries the request, so an authorization
+     * Every account lookup and write carries the request, so an authorization
      * plugin answers for the caller: without it, a route read as an internal
      * call, and a delegated administrator could read or unlock any account of
      * the directory (#325).
      */
     private getPasswordStatus;
+    private readUser;
     /**
      * Calculate password status from LDAP entry and policy
      */
@@ -222,17 +269,47 @@ export default class PasswordPolicy extends DmPlugin {
      */
     private findLockedAccounts;
     /**
-     * Read ppolicy configuration from LDAP
+     * The policy the overlay applies to an entry: the one its
+     * pwdPolicySubentry names, else the default one, which slapd also falls
+     * back to when the named entry holds no policy
+     */
+    private policyFor;
+    /**
+     * Read the default ppolicy: --ppolicy-default-dn, else the only policy
+     * under the policy base
      */
     private readPolicyConfig;
     /**
-     * Parse ppolicy entry to config object
+     * With several policies, the default one is named in slapd's
+     * configuration (olcPPolicyDefault), which this server cannot read
+     */
+    private discoverDefaultDn;
+    /**
+     * Read the policy at `dn`, null when it holds none
+     */
+    private readPolicyAt;
+    private forgetPolicies;
+    private policyBase;
+    /**
+     * The policy entries under the policy base matching `filter`, none when
+     * the base itself is missing
+     */
+    private searchPolicies;
+    /**
+     * The policy named `cn` under the policy base
      */
-    private parsePolicyEntry;
+    private findPolicy;
+    private listPolicies;
+    private toPolicyRecord;
     /**
-     * Parse number from LDAP attribute value
+     * The directory form of a value a client sent for policy attribute `name`
      */
-    private parseNumber;
+    private policyValue;
+    private createPolicy;
+    private updatePolicy;
+    private deletePolicy;
+    private assignPolicy;
+    private param;
     /**
      * Parse GeneralizedTime (YYYYMMDDHHmmssZ) to Date
      */

package/dist/src/plugins/twake/clouderyProvision.d.ts

@@ -52,7 +52,13 @@ export default class ClouderyProvision extends DmPlugin {
     private createInstance;
     /** Poll the workflow until it succeeds. Returns false on failure/timeout. */
     private waitForWorkflow;
-    private findInstanceUuidByFqdn;
+    /**
+     * The instance at this FQDN, if any.
+     *
+     * @param fqdn instance address
+     * @param only the one field to ask for, when the others are not needed
+     */
+    private findInstanceByFqdn;
     private deleteInstance;
     private publishUserCreated;
     private publishUserDeleted;

package/docs/client-development/api/rest-api.md

@@ -1183,6 +1183,15 @@ move names both DNs:
 }
 ```
 
+**DN that cannot be parsed** — an organization read or a move target that is
+not a DN (LDAP result code 34):
+
+```json
+{
+  "error": "garbage is not a valid DN"
+}
+```
+
 #### 401 Unauthorized
 
 **Missing Authentication:**
@@ -1227,6 +1236,16 @@ move names both DNs:
 }
 ```
 
+**Entry or value the directory does not hold** — a modify or a delete of an
+entry that is not there, or the removal of a value the entry lacks (LDAP
+result codes 32 and 16). Removing a group member that is not one names both:
+
+```json
+{
+  "error": "uid=alice,ou=users,dc=example,dc=com is not a member of cn=backend-guild,ou=groups,dc=example,dc=com"
+}
+```
+
 #### 409 Conflict
 
 **Duplicate Entry:**

package/docs/usage/configuration.md

@@ -260,6 +260,22 @@ at `0` otherwise.
 | `--trash-add-metadata`  | `DM_TRASH_ADD_METADATA`  | `true`  | Add deletion metadata       |
 | `--trash-auto-create`   | `DM_TRASH_AUTO_CREATE`   | `true`  | Auto-create trash container |
 
+#### `core/ldap/passwordPolicy`
+
+Policy management, password status and lockouts, see [password policy](plugins/ldap/password-policy.md).
+
+| CLI                             | Env                              | Default       | Description                                                                                 |
+| ------------------------------- | -------------------------------- | ------------- | ------------------------------------------------------------------------------------------- |
+| `--ppolicy-default-dn`          | `DM_PPOLICY_DEFAULT_DN`          |               | Default policy, [needed with several](plugins/ldap/password-policy.md#which-policy-applies) |
+| `--ppolicy-base`                | `DM_PPOLICY_BASE`                | `--ldap-base` | Where policies are looked for and created                                                   |
+| `--ppolicy-warn-days`           | `DM_PPOLICY_WARN_DAYS`           | `14`          | Days before expiration to flag as "expiring soon"                                           |
+| `--ppolicy-validate-complexity` | `DM_PPOLICY_VALIDATE_COMPLEXITY` | `false`       | Enable `POST /password/validate`                                                            |
+| `--ppolicy-min-length`          | `DM_PPOLICY_MIN_LENGTH`          | `12`          | Minimum length checked by `/password/validate`                                              |
+| `--ppolicy-require-uppercase`   | `DM_PPOLICY_REQUIRE_UPPERCASE`   | `true`        | Require an uppercase letter                                                                 |
+| `--ppolicy-require-lowercase`   | `DM_PPOLICY_REQUIRE_LOWERCASE`   | `true`        | Require a lowercase letter                                                                  |
+| `--ppolicy-require-digit`       | `DM_PPOLICY_REQUIRE_DIGIT`       | `true`        | Require a digit                                                                             |
+| `--ppolicy-require-special`     | `DM_PPOLICY_REQUIRE_SPECIAL`     | `true`        | Require a special character                                                                 |
+
 #### `core/ldap/onChange`
 
 Monitors LDAP modifications and triggers hooks for attribute changes. No configuration options - uses [Special Attributes](#special-attributes) settings.

package/docs/usage/plugins/integrations/instances.md

@@ -36,6 +36,12 @@ gets no instance.
   the publication and the mark sends it again on the next attempt, and two
   replicas handling the same account at once may both send it. Within one
   replica, the work on one account is done one step at a time.
+- An entry another tool created, whose classes do not allow the address or
+  the mark, is given the auxiliary class of `--user-class` that allows it,
+  as the
+  [repair of entries created by other tools](../ldap/flat-generic.md#entries-created-by-other-tools)
+  does, whether the address comes from `workplace.created` or from making
+  sure of its instance.
 - The server does not start without a reachable broker, and an event that
   cannot be published fails its attempt rather than being marked as sent.
 - With cozy-stack, deleting an account destroys its instance, when that
@@ -55,7 +61,9 @@ cannot write is refused before the provider or the broker hear of it.
 
 Pending accounts are the entries under the `--twake-instance-dn` branches
 with a mail and no address, for instance
-`(&(mail=*)(!(twakeWorkspaceUrl=*)))`, technical accounts aside.
+`(&(mail=*)(!(twakeWorkspaceUrl=*)))`, technical accounts aside. The route
+can be called for each of them: an account already announced answers
+`ready` and is left as it is.
 
 ## Organizations
 
@@ -122,11 +130,15 @@ organization entry, and is refused with a `403` otherwise.
   already there is taken only when its email and OIDC id are this account's.
 
 The instance id is `--twake-instance-id`, a template of the account's `uid`
-and the named groups of the matching DN expression, for example
-`{uid}{org}`; dots are dropped. A name no expression captures stops the
-server at startup. It is the slug of the instance's address; the OIDC id is
-this slug with the Cloudery, and the `uid` with cozy-stack. `user.created`
-names the account by its `uid` (`twakeId`). A group named `org` is the organization id sent to the provider
+and the named groups of the matching DN expression, for example `{uid}{org}`.
+It is lowercased and reduced to `[a-z0-9-]`: the Cloudery refuses other
+characters in a slug, such as `_` or `@`, so `jane.doe_stg` gives
+`janedoestg`. Two `uid`s that reduce to the same slug cannot both have an
+instance: the second is refused, as an instance already there that is not its
+own. A name no expression captures stops the server at startup. It is the slug
+of the instance's address; the OIDC id is this slug with the Cloudery, and the
+`uid` with cozy-stack. `user.created` names the account by its `uid`
+(`twakeId`). A group named `org` is the organization id sent to the provider
 and in `user.created`, with the mail's domain as its domain; with cozy-stack
 and no such group, `--twake-instance-cozy-org-id` and
 `--twake-instance-cozy-org-domain` stand for them.

package/docs/usage/plugins/ldap/README.md

@@ -15,7 +15,7 @@ Plugins for LDAP entity management.
 | [on-change](on-change.md)                 | All                      | Change detection                        |
 | [enterprise-rules](enterprise-rules.md)   | All (business rules)     | Uniqueness, Mail domains, Delete guards |
 | [account-lifecycle](account-lifecycle.md) | Accounts                 | Enable/disable, Password reset          |
-| [password-policy](password-policy.md)     | Password management      | Expiration, Lockout, Unlock             |
+| [password-policy](password-policy.md)     | Password management      | Policies, Expiration, Lockout, Unlock   |
 | [raw](raw.md)                             | Whole directory (read)   | Root DSE, Schema, Tree, Raw search      |
 
 ## API Endpoints
@@ -63,6 +63,12 @@ GET    /api/v1/users/{id}/password-status       # Get user password status
 POST   /api/v1/users/{id}/unlock                # Unlock locked account
 GET    /api/v1/password-policy/expiring-soon    # List expiring passwords
 GET    /api/v1/password-policy/locked-accounts  # List locked accounts
+GET    /api/v1/password-policies                # List policies
+POST   /api/v1/password-policies                # Create a policy
+GET    /api/v1/password-policies/{cn}           # Read a policy
+PATCH  /api/v1/password-policies/{cn}           # Change a policy
+DELETE /api/v1/password-policies/{cn}           # Delete a policy
+PUT    /api/v1/users/{id}/password-policy       # Assign a policy
 POST   /api/v1/password/validate                # Validate complexity (optional)
 ```
 

package/docs/usage/plugins/ldap/account-lifecycle.md

@@ -99,7 +99,13 @@ It used to be taken as an absent one, so `{"password": ""}` answered
 that emptied the field by accident believed it had set the password it typed.
 Omitting the field is how a generated password is asked for.
 
-`forceChange` (true by default) also writes the `passwordReset`-role attribute
+A password longer than 256 characters, or holding a control character (a NUL
+byte, a newline…), is refused too: nobody can type it at a login prompt. The
+endpoint applies no minimum length or complexity rule of its own. These rules
+belong to this endpoint: a password written as an attribute, through
+`PUT /api/v1/ldap/{pluralName}/{id}` or a creation, is not checked.
+
+`forceChange` (a boolean, true by default) also writes the `passwordReset`-role attribute
 so the directory asks for a new password at next login. For a boolean
 attribute the values written are `TRUE` and `FALSE`; a directory that spells
 them otherwise says so through `states.required` and `states.cleared`.
@@ -120,6 +126,8 @@ them otherwise says so through `states.required` and `states.cleared`.
 | ------ | -------------------------------------------------------------- |
 | `400`  | Unknown state, or a body with no `state`                       |
 | `400`  | A `password` that is present but empty, `null` or not a string |
+| `400`  | A `password` over 256 characters or with a control character   |
+| `400`  | A `forceChange` that is not a boolean                          |
 | `404`  | No such account                                                |
 
 ## See also

package/docs/usage/plugins/ldap/flat-generic.md

@@ -443,25 +443,27 @@ An entry written by another tool may lack an object class the schema
 declares, and the directory then refuses an attribute that class carries: a
 bare `inetOrgPerson` in the users branch cannot take `twakeDepartmentLink`,
 which `twakeWhitePages` brings. When a modify through LDAP-Rest (this route,
-`/move`, a state change…) writes such an attribute, the **auxiliary** class
-declared for the branch that allows it is added in the same write, provided
-the entry holds, or receives, that class's mandatory attributes. Only what
-the write needs is added, and a write the directory would accept is never
-changed: several entities may share a branch (`users`, `posixAccounts` and
-`sshPublicKeys` all live in `ou=users`) without every entry being given all
-their classes.
+`/move`, a state change…) writes such an attribute and the directory refuses
+it, the write is sent again with the **auxiliary** class declared for the
+branch that allows it, provided the entry holds, or receives, that class's
+mandatory attributes. Only what the write needs is added, and a write the
+directory would accept is never changed: several entities may share a
+branch (`users`, `posixAccounts` and `sshPublicKeys` all live in `ou=users`)
+without every entry being given all their classes.
 
 A missing **structural** class, such as `twakeAccount`, cannot be added to an
 existing entry: the write answers `409`, and the reason is logged once per
 entry. The same applies to groups under `--ldap-group-base` (when it is set)
 with `--group-class`, and to the organization tree with
-`--ldap-organization-class`. Nothing is added when the change names
-`objectClass` itself.
+`--ldap-organization-class`, and to the accounts the Twake instance and
+Cloudery provisioning plugins write, with `--user-class`. Nothing is added
+when the change names `objectClass` itself.
 
 The repair reads the directory schema, kept for
-`--ldap-raw-schema-cache-ttl`, and the entry's classes when a written
-attribute belongs to a declared auxiliary class. `DM_LDAP_FLAT_AUTO_REPAIR=false`
-turns it off.
+`--ldap-raw-schema-cache-ttl`, and the entry's classes only for a write the
+directory refuses: a write it takes costs nothing more. That refused write
+shows in the directory's logs (`err=65`) before the one adding the class.
+`DM_LDAP_FLAT_AUTO_REPAIR=false` turns the repair off.
 
 ### Delete Entry
 

package/docs/usage/plugins/ldap/password-policy.md

@@ -1,6 +1,6 @@
 # Password Policy Plugin
 
-The `passwordPolicy` plugin provides a REST API for managing OpenLDAP password policies (ppolicy overlay). It allows administrators to monitor password expiration, manage locked accounts, and optionally validate password complexity.
+The `passwordPolicy` plugin provides a REST API for managing OpenLDAP password policies (ppolicy overlay). It allows administrators to edit the policies, monitor password expiration, manage locked accounts, and optionally validate password complexity.
 
 ## Overview
 
@@ -10,6 +10,7 @@ This plugin acts as an administration interface for OpenLDAP's ppolicy overlay.
 - Account unlock functionality
 - List users with expiring passwords
 - List locked accounts
+- [Policy management](#managing-policies): list, create, edit, delete, and assign to accounts
 - Optional local password complexity validation
 
 **Note:** ldap-rest is an administration backend. Users authenticate directly against OpenLDAP, not through ldap-rest. This plugin exposes ppolicy attributes via REST API for administrative purposes.
@@ -34,9 +35,24 @@ This plugin acts as an administration interface for OpenLDAP's ppolicy overlay.
 | Argument               | Environment Variable    | Default       | Description                                       |
 | ---------------------- | ----------------------- | ------------- | ------------------------------------------------- |
 | `--ppolicy-default-dn` | `DM_PPOLICY_DEFAULT_DN` | (auto-detect) | DN of the default password policy entry           |
+| `--ppolicy-base`       | `DM_PPOLICY_BASE`       | `{ldap_base}` | Where policies are looked for and created         |
 | `--ppolicy-warn-days`  | `DM_PPOLICY_WARN_DAYS`  | `14`          | Days before expiration to flag as "expiring soon" |
 | `--ldap-users-base`    | `DM_LDAP_USERS_BASE`    | `{ldap_base}` | Base DN for user searches                         |
 
+### Which policy applies
+
+An account is judged by the policy its `pwdPolicySubentry` names, else by the
+default one, as slapd does. The default policy is set in slapd's
+configuration (`olcPPolicyDefault`), which this server cannot read: give it
+with `--ppolicy-default-dn`. Without it, the plugin takes the only policy
+under `--ppolicy-base`; when there are several, it takes none and logs a
+warning, and accounts without `pwdPolicySubentry` are reported without
+expiry.
+
+The bind user must be able to read `pwdPolicySubentry`: hidden by an ACL, it
+reads as absent and every account is judged by the default policy (see
+[Cannot Read Operational Attributes](#cannot-read-operational-attributes)).
+
 ### Optional Complexity Validation
 
 Enable local password complexity validation (for client-side feedback before submitting to LDAP):
@@ -124,7 +140,8 @@ curl "http://localhost:8081/api/v1/users/uid%3Djohn.doe%2Cou%3Dusers%2Cdc%3Dexam
   "isLocked": false,
   "lockedAt": null,
   "failureCount": 0,
-  "graceLoginsUsed": 0
+  "graceLoginsUsed": 0,
+  "policy": "cn=default,ou=policies,dc=example,dc=com"
 }
 ```
 
@@ -279,6 +296,69 @@ POST /api/v1/password/validate
 }
 ```
 
+## Managing policies
+
+```http
+GET    /api/v1/password-policies             # List
+POST   /api/v1/password-policies             # Create
+GET    /api/v1/password-policies/{cn}        # Read
+PATCH  /api/v1/password-policies/{cn}        # Change
+DELETE /api/v1/password-policies/{cn}        # Delete
+PUT    /api/v1/users/{id}/password-policy    # Assign to an account
+```
+
+Policies are found by `cn` under `--ppolicy-base`. A policy is served with
+the attributes it holds, typed: durations and counts as integers, `TRUE` /
+`FALSE` as booleans, and `isDefault` marking the default one:
+
+```json
+{
+  "dn": "cn=software,ou=policies,dc=example,dc=com",
+  "cn": "software",
+  "isDefault": false,
+  "pwdAttribute": "userPassword",
+  "pwdMaxFailure": 10,
+  "pwdLockout": true,
+  "pwdMustChange": false
+}
+```
+
+**Changing a policy:** `PATCH` sets the attributes it names; `null` removes
+one. Sending back what `GET` served is accepted as long as `dn`, `cn`,
+`isDefault` and the read-only attributes keep their value.
+
+```bash
+curl -X PATCH "http://localhost:8081/api/v1/password-policies/default" \
+  -H 'Content-Type: application/json' \
+  -d '{"pwdMaxAge": 31536000, "pwdExpireWarning": null}'
+```
+
+- `pwdAttribute` and `pwdCheckModule` are read-only. Before OpenLDAP 2.6,
+  `pwdCheckModule` is the path of a library slapd loads; set it in slapd.
+- `pwdCheckModuleArg`, the configuration of the quality-check module (ppm,
+  for instance), is a string, usually of several lines. Writing it, or
+  `pwdUseCheckModule`, gives the entry the `pwdPolicyChecker` class. Both
+  need OpenLDAP 2.6; an older directory refuses them with a `400`.
+- An attribute the directory's schema does not know is refused with a `400`
+  naming it.
+
+**Creating a policy:** `POST` takes `cn` and the attributes to set. The entry
+is created under `--ppolicy-base` as a `person` holding `pwdPolicy`, as in
+the OpenLDAP administrator's guide, applied to `userPassword`. A policy of
+the same name answers `409`. `--ppolicy-base` must exist: otherwise creating
+answers `404` and listing finds nothing, with a warning in the log.
+
+**Deleting a policy** is refused (`409`) while it is the default one or an
+entry's `pwdPolicySubentry` names it. The default one is only known through
+`--ppolicy-default-dn` when there are several: without it, nothing stops
+deleting the policy slapd applies by default. Looking for the entries that
+name the policy searches the whole of `--ldap-base`; unless
+`pwdPolicySubentry` is indexed, that is a full scan on each delete.
+
+**Assigning a policy:** `PUT /users/{id}/password-policy` with
+`{"policy": "software"}` sets the account's `pwdPolicySubentry`; with
+`{"policy": null}` the account gets the default policy again.
+
 ## OpenLDAP ppolicy Attributes
 
 The plugin reads these operational attributes from user entries:
@@ -364,7 +444,8 @@ async function validatePassword(password) {
 
 **Problem:** `GET /password-policy` returns `{}`
 
-**Solution:** The ppolicy overlay may not be configured in OpenLDAP, or the ppolicy entry doesn't exist. Configure the overlay and create a pwdPolicy entry:
+**Solution:** With several policies, set `--ppolicy-default-dn` (see
+[Which policy applies](#which-policy-applies)). Otherwise the ppolicy overlay may not be configured in OpenLDAP, or the ppolicy entry doesn't exist. Configure the overlay and create a pwdPolicy entry, through [`POST /password-policies`](#managing-policies) or:
 
 ```ldif
 dn: cn=default,ou=policies,dc=example,dc=com
@@ -396,7 +477,7 @@ pwdLockoutDuration: 900
 **Solution:** Ensure the LDAP bind user has permissions to read operational attributes. These require special ACLs in OpenLDAP:
 
 ```
-access to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdGraceUseTime,pwdReset
+access to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdGraceUseTime,pwdReset,pwdPolicySubentry
     by dn="cn=admin,dc=example,dc=com" read
     by self read
     by * none
@@ -420,6 +501,9 @@ The plugin automatically exports its configuration via the `configApi` plugin. W
         "unlockUser": "/api/v1/users/:id/unlock",
         "getExpiringSoon": "/api/v1/password-policy/expiring-soon",
         "getLockedAccounts": "/api/v1/password-policy/locked-accounts",
+        "listPolicies": "/api/v1/password-policies",
+        "policy": "/api/v1/password-policies/:cn",
+        "assignPolicy": "/api/v1/users/:id/password-policy",
         "validatePassword": "/api/v1/password/validate"
       },
       "config": {

package/docs/usage/upgrading.md

@@ -4,6 +4,44 @@ What to check before deploying, newest first. Only releases that need a
 decision or a configuration change appear here; see the
 [CHANGELOG](../../CHANGELOG.md) for everything else.
 
+## To 0.21.0
+
+### Accounts another tool created
+
+**Who is affected:** a deployment that loads `twake/instances` with the
+Cloudery, where another tool creates accounts under `--twake-instance-dn`
+without the classes of `--user-class` (a plain `inetOrgPerson`, say).
+
+Those accounts have an instance but neither its address nor the mark: the
+directory refused the write. Once deployed,
+[make sure of each pending account](plugins/integrations/instances.md#making-sure-an-account-has-its-instance): the call gives it the class it needs.
+
+### Several password policies
+
+**Who is affected:** a deployment that loads `core/ldap/passwordPolicy`
+without `--ppolicy-default-dn`, whose directory holds several `pwdPolicy`
+entries.
+
+`GET /password-policy` answers `{}` and accounts without
+`pwdPolicySubentry` are reported without expiry, until
+`--ppolicy-default-dn` names the policy slapd's `olcPPolicyDefault` names. A
+warning in the log says so.
+
+## To 0.20.3
+
+### Members whose uid the Cloudery refused as a slug
+
+**Who is affected:** a deployment that loads `twake/instances` with the
+Cloudery, whose members were created through SCIM or the API with a `uid`
+holding characters such as `_` or `@`.
+
+Those members got no instance: the Cloudery refused their slug. Once
+deployed,
+[make sure of each pending account](plugins/integrations/instances.md#making-sure-an-account-has-its-instance).
+Two members whose `uid`s reduce to the same slug cannot both have an
+instance: the second call answers `409`,
+[details](plugins/integrations/instances.md#providers).
+
 ## To 0.20.2
 
 ### Members of organizations created before 0.13.0
@@ -11,20 +49,12 @@ decision or a configuration change appear here; see the
 **Who is affected:** a deployment that loads `twake/instances` with the
 Cloudery and has organizations created before 0.13.0 that got members since.
 
-Those members have neither an address (`twakeWorkspaceUrl`, or
-`--twake-instance-fqdn-attribute`) nor the mark (`twakeCreatedEventAt`, or
-`--twake-instance-sent-attribute`), and adding another member does not
-release them. Once deployed, find them under each organization entry with
-
-```
-(&(uid=*)(mail=*)(!(twakeWorkspaceUrl=*))(!(twakeCreatedEventAt=*)))
-```
-
-and call `POST /api/v1/twake/instances/ensure` with `{ "dn": … }` for each,
+Those members have neither an address nor the mark, and adding another
+member does not release them. Once deployed,
+[make sure of each pending account](plugins/integrations/instances.md#making-sure-an-account-has-its-instance),
 as a caller who may write the organization entry. The first call announces
-the organization. Each call asks for the member's instance, and the member's
-`user.created` follows once it is built,
-[details](plugins/integrations/instances.md#organizations).
+the organization, and each member's `user.created` follows once its instance
+is built, [details](plugins/integrations/instances.md#organizations).
 
 ## To 0.20.0
 

package/examples/web/README.md

@@ -116,9 +116,13 @@ npm start -- --plugin core/ldap/raw
    ```bash
    npm start -- \
      --plugin core/auth/totp \
-     --auth-totp "JBSWY3DPEHPK3PXP:admin:6"
+     --auth-totp "JBSWY3DPEHPK3PXP:admin:6" \
+     --auth-path-prefix /api
    ```
 
+   `--auth-path-prefix /api` leaves the example pages themselves reachable
+   without a code.
+
 3. **Open examples in browser:**
    ```
    http://localhost:8081/static/examples/web/totp-client.html

package/examples/web/ldap-user-editor.html

@@ -97,7 +97,6 @@
         processFormData,
         loadPointerOptions,
         replaceSchemaPlaceholders,
-        getOrganizationPath,
       } = window.MiniDmShared;
 
       let editor;
@@ -136,12 +135,6 @@
           throw new Error('No schema available for users');
         }
 
-        // Get organization path for twakeDepartmentPath
-        const orgPath = await getOrganizationPath(
-          currentOrgDn,
-          window.location.origin
-        );
-
         // Replace placeholders in schema branches
         const ldapBase = editor.getConfig().ldapBase;
         userSchema = replaceSchemaPlaceholders(userSchema, {
@@ -170,9 +163,17 @@
           userSchema.attributes
         )) {
           if (attribute.fixed) continue; // Skip fixed fields like 'dn'
+          // The server sets these, and refuses them from a client
+          if (
+            attribute.readOnly ||
+            (attribute.generated &&
+              (fieldName !== userSchema.entity?.mainAttribute ||
+                attribute.generatedFrom))
+          )
+            continue;
           if (fieldName === 'objectClass') continue; // Already handled
 
-          // Auto-fill twakeDepartmentLink and twakeDepartmentPath
+          // The organization is the one selected in the tree
           if (fieldName === 'twakeDepartmentLink') {
             fieldsHtml += `
               <input type="hidden" name="twakeDepartmentLink" value="${escapeHtml(currentOrgDn)}" />
@@ -180,13 +181,6 @@
             continue;
           }
 
-          if (fieldName === 'twakeDepartmentPath') {
-            fieldsHtml += `
-              <input type="hidden" name="twakeDepartmentPath" value="${escapeHtml(orgPath)}" />
-            `;
-            continue;
-          }
-
           fieldsHtml += await generateFormField(fieldName, attribute, {
             pointerOptionsLoader: pointerLoader,
           });