https://bugs.openldap.org/show_bug.cgi?id=9740
--- Comment #3 from Ondřej Kuzník ondra@mistotebe.net --- On Fri, Nov 05, 2021 at 01:09:06PM +0000, openldap-its@openldap.org wrote:
What is your usecase where you'd need different modules in the same server?
No particular use case.
It's just that before ppm, LTB project maintained another module named "check-password", and maybe it can help the transition to announce that OpenLDAP support multiple modules at one time... But again there is no real use case.
Then I would wait until a compelling use case comes up before we consider reverting that change.
2/ it does not seem to work. (ie the extended module is not launched). See below for my config and data.
Just checking you are actually building with --enable-modules?
Yes indeed.
If it can help:
./configure [...]
Yes, that's fine, checking your policy again: - pwdCheckQuality is 2, great, but the password you're setting is hashed already so it will just fail before considering whether the module should be used - you are not using pwdUseCheckModule - the module configured will not actually be used even if dealing with plaintext passwords
At least section 4.2.6 of the Behera draft[0] implicitly suggests that password administrators should be exempt from quality checking by being able to "set or reset the password to a well-known value." Is that the reason it wasn't being used for you or are you still having issues regardless of the above?
The manpage doesn't seem to document that the module is not used unless pwdCheckQuality is also enabled. I'll see about fixing that, thanks.
Thanks for the clarification. Actually, I meant the documentation of slapo-ppolicy (man page) it could be nice to explain:
- what is deprecated
- what is each attribute made for
That's already documented here: https://git.openldap.org/openldap/openldap/-/blob/master/doc/man/man5/slapo-...
Could you suggest any improvements to address whatever other confusion you think exists?
Thanks,
[0]. https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10#s...