We are using Samba as a user directory for our application. Passwords are stored in unicodePwd attribute, and our application resets passwords through LDAP (without the knowledge of the previous password, because it's an email-based reset). Unfortunately resetting it like this prevents the "password history" policy enforcement. This is a security problem that will come up on the first security audit. Microsoft recognised this is a problem and in Windows 2008 R2 SP1 introduced a supportedControl on RootDSE: LDAP_SERVER_POLICY_HINTS_DEPRECATED_OID (1.2.840.113556.1.4.2066), later LDAP_SERVER_POLICY_HINTS_OID (1.2.840.113556.1.4.2239), which enables such password history enforcement on LDAP password resets. Garming has suggested a way to approach this here: https://lists.samba.org/archive/samba/2016-July/201208.html
Created attachment 12283 [details] a work in progress patch for this This is a patch I knocked up for this. It passes our own tests, but I've not tested against windows yet. We may choose not to implement the _DEPRICATED OID in the end. It needs a tidy up regarding names etc, and to check the flags in the password_hash code.
Hi, Any comment on the patch? Does this seems valuable? Any plan to implement it? Thank you very much,
This turned out to be a bit more complex than we imagined, so it never made it in. I can't remember the details, I expect it didn't actually pass our own tests.
https://lists.samba.org/archive/samba/2024-August/249724.html notes that Keycloak uses this. The Microsoft dochelp team are looking into the meaning of this for us in https://lists.samba.org/archive/cifs-protocol/2025-September/004589.html
This bug was referenced in samba master: 49001e81589e8b5e4437b45f25622b07eecc95a5 b003beb85a648eae5bfe7e38362abd8d798e8f86 aff40feb3d749f019b1c96ba90342a10ae721a7f d588c7969ee7586d2f76cb1a66b542c63fe7d154 0da540f4d8323fb78ba25bedec9fbef5dddd43bf cdf2defdc573a01b8308dd1710a73bb2a4e088bb e1188962aa9cec9ab6cf2f4ddaaf19dce858d2dd 04039fdd835690f636906fb58743ff6f91451de8
Created attachment 18800 [details] patch for 4.22 and 4.23