fix(bootstrap): allow management changes with old password

CHANGELOG.md

@@ -60,6 +60,8 @@ Project-specific changes only. See upstream [OpenLDAP release notes](https://www
 
 ### Fixed
 
+- Allow management password changes carrying the old password, as used by
+  Authelia, while keeping password hashes/history and LDAP Compare protected.
 - Restore passing build checks by using Go 1.26.10 (fixing GO-2026-6809 in the
   build toolchain) and satisfying the password-history test's staticcheck rule.
 

build/README.md

@@ -27,7 +27,8 @@ After the shared version check, `tests/` runs integration scenarios on each buil
   hashes/history, and protected service accounts, own account and configuration;
 - standard users/groups/services tree and management account: independent opt-ins,
   custom DNs and supplied OUs, generated passwords, user/group
-  reads, password resets including application administrators, ppolicy-safe resets,
+  reads, password resets including application administrators, old-password-verified
+  management changes, ppolicy-safe resets,
   configurable hidden attributes with/without ppolicy, rejection of empty combined
   lists, hidden hashes/history by default, and denied profile, membership, entry
   and service changes;

build/tests/testdata/data-management.sh

@@ -103,6 +103,13 @@ for dn in "${USER_DN}" "${APP_ADMIN_DN}"; do
 done
 ok 'management resets ordinary and application-admin passwords without the old password'
 
+# Authelia also supplies the old password to the password-modify extension.
+expect_fail ldappasswd -x -H "${URI}" -D "${TEST_MANAGEMENT_DN}" -w "${TEST_PASSWORD}" -a wrong-password -s "${NEXT_PASSWORD}" "${USER_DN}"
+expect_rc 0 ldappasswd -x -H "${URI}" -D "${TEST_MANAGEMENT_DN}" -w "${TEST_PASSWORD}" -a "${NEW_PASSWORD}" -s "${NEXT_PASSWORD}" "${USER_DN}"
+expect_rc 0 ldapwhoami -x -H "${URI}" -D "${USER_DN}" -w "${NEXT_PASSWORD}"
+expect_rc 0 ldappasswd -x -H "${URI}" -D "${TEST_MANAGEMENT_DN}" -w "${TEST_PASSWORD}" -s "${NEW_PASSWORD}" "${USER_DN}"
+ok 'management changes passwords with a verified old password without hash read/compare'
+
 if [[ "${TEST_MANAGEMENT_MODE}" = policy* && "${TEST_MANAGEMENT_MODE}" != "policy-disabled" ]]; then
     # Authelia's standard LDAP Modify also needs to work with pwdSafeModify=TRUE.
     expect_rc 0 bind_modify "${URI}" "${TEST_MANAGEMENT_DN}" <<LDIF
@@ -128,7 +135,7 @@ LDIF
     ok 'policy-enabled LDAP Modify hashes passwords and honors history visibility settings'
 fi
 
-# Write-only password access must not even permit comparison of stored hashes.
+# Password auth/write/manage access must not permit comparison of stored hashes.
 expect_rc 50 ldapcompare -x -H "${URI}" -D "${TEST_MANAGEMENT_DN}" -w "${TEST_PASSWORD}" "${USER_DN}" "userPassword:${NEW_PASSWORD}"
 
 expect_fail bind_modify "${URI}" "${TEST_MANAGEMENT_DN}" <<LDIF

services/openldap-bootstrap/assets/ldif/README.md

@@ -135,7 +135,7 @@ its identifier, but cannot modify, rename, delete or reset its own account.
 Other service accounts, entries outside users/groups and `cn=config` stay protected.
 Use data root to rotate the directory administrator's password.
 
-Password resets use the same `=wm` privileges as management resets. With ppolicy,
+Password resets use the same write/manage privileges as management resets. With ppolicy,
 these administrative resets bypass quality, history-reuse and minimum-age checks;
 the application performing them must enforce the required password rules.
 This remains a powerful identity-management account: it can reset users' passwords
@@ -166,8 +166,10 @@ When ppolicy is enabled, `OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_HIDDEN_PPOLICY_ATTR
 is added (default `pwdHistory`). The combined list must not be empty.
 
 `63-database-management-acl.ldif.template` limits password writes to the users branch.
-Its `=wm` privileges allow administrative resets without the old password, without
-hash read/compare. With ppolicy, these resets bypass quality, history-reuse and
+Its `=wmx` privileges allow administrative resets without the old password and
+password changes that supply the old password, as Authelia does. The auth (`x`)
+bit lets OpenLDAP verify that password without granting hash read/compare.
+With ppolicy, these operations bypass quality, history-reuse and
 minimum-age checks: enforce password requirements in the application.
 Service accounts and configuration remain protected; other identities keep their
 usual ACLs.

services/openldap-bootstrap/assets/ldif/config/database-management/63-database-management-acl.ldif.template

@@ -1,7 +1,8 @@
-# Grant only write and password-administrator privileges, without hash read/compare.
-# The manage bit allows ppolicy resets without knowing the old password.
+# Grant auth, write and password-administrator privileges, without hash read/compare.
+# Auth allows password changes carrying the old password (e.g. Authelia).
+# Manage allows ppolicy resets without knowing the old password.
 olcAccess: to dn.subtree="${OPENLDAP_BOOTSTRAP_DATA_TREE_USERS_DN}" attrs=userPassword
-  by dn.exact="${OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_DN}" =wm
+  by dn.exact="${OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_DN}" =wmx
   by * break
 olcAccess: to attrs=${OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_HIDDEN_ATTRIBUTES}
   by dn.exact="${OPENLDAP_BOOTSTRAP_DATA_MANAGEMENT_DN}" none