[Issue 9671] pwdPolicySubentry: no user modification allowed

--- Comment #4 from Michael Ströder <michael(a)stroeder.com&gt; --- (In reply to Ondřej Kuzník from comment #3) > I've already had to > make changes to the local version where things were omitted: > https://git.openldap.org/openldap/openldap/-/commit/ > 2b007d01dbd924cf11f88c2f8dbba26b5ba8b593 Hmm, not sure whether that leads to more interoperability. > Sounds like adding manage permissions on the attribute (and maybe the > "entry" attribute) could be a targeted way of allowing this operation? I strongly dislike having to use the Relax Rules control to let the admin change pwdPolicySubentry. IMO this control must only be used in exceptional administrative use-cases. I have a very strong opinion on this. In my local OpenLDAP 2.5.x builds I now simply remove NO-USER-MODIFICATION. Ideally I'd prefer not having to deal with pwdPolicySubentry at all. But until ITS#9343 is implemented NO-USER-MODIFICATION should be removed. Another solution would be to have a separate attribute fooPasswordPolicy (or whatever name you'd prefer) for overriding per entry the computed pwdPolicySubentry. It also allows to always compute the effective pwdPolicySubentry including applying defaults. This is the approach at least one other LDAP server implements.