https://bugs.openldap.org/show_bug.cgi?id=10589
Issue ID: 10589 Summary: multiple issues with ppolicy rules and rehash in ppolicy Product: OpenLDAP Version: 2.7.1 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: overlays Assignee: bugs@openldap.org Reporter: david.coutadeur@gmail.com Target Milestone: ---
Created attachment 1202 --> https://bugs.openldap.org/attachment.cgi?id=1202&action=edit OpenLDAP Configuration
Hello,
I have tested recently the new ppolicy features of OpenLDAP 2.7.1.
Thanks for this great work! The new features sound really exciting.
Nevertheless, I have encountered some issues during testing. As these are new features, I don't know if this is a misconfiguration problem coming from me, or if there are bugs.
You can find attached the configuration and data I have used.
1. I noticed that pwdPolicySubentry as static attribute is now deprecated. How could we assign directly a specific policy to a user in the future?
2. Using olcPPolicyRuleGroupAttr attribute in a scope rule generates a coredump while OpenLDAP tries to evaluate the assigned ppolicy. (ie during user entry loading). See the configuration.
3. I tried to configure a regex rule for assigning password policies. OpenLDAP crashes when trying to compute the assigned ppolicy. (when searching a user entry matching the policy). Maybe I have not correctly defined the regex rule, but I found no concrete example of this in documentation or unit tests.
4. Trying to run OpenLDAP in debug mode with TRACE level. (-d -1), whith given configuration and data makes OpenLDAP crash at startup, with no special log. It is due to scope and regex rules, as when I remove them, OpenLDAP starts normally.
5. For pwdRehashOnBind feature, I didn't understand the "If pwdReset is set to "TRUE"" part in the man page. The current behaviour I observed is that when pwdReset is TRUE, the password is never rehashed. What is the intent here?
6. When I try to modify a password from a user having a directly assigned ppolicy (pwdPolicySubentry defined statically), the password is never rehashed.
Thanks in advance for your help!
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #1 from David Coutadeur david.coutadeur@gmail.com --- Created attachment 1203 --> https://bugs.openldap.org/attachment.cgi?id=1203&action=edit OpenLDAP data
https://bugs.openldap.org/show_bug.cgi?id=10589
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|bugs@openldap.org |ondra@mistotebe.net Target Milestone|--- |2.7.2
https://bugs.openldap.org/show_bug.cgi?id=10589
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords|needs_review |
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #2 from Ondřej Kuzník ondra@mistotebe.net --- On Mon, Sep 14, 2026 at 03:03:45PM +0000, openldap-its@openldap.org wrote:
Hello,
I have tested recently the new ppolicy features of OpenLDAP 2.7.1.
Thanks for this great work! The new features sound really exciting.
Nevertheless, I have encountered some issues during testing. As these are new features, I don't know if this is a misconfiguration problem coming from me, or if there are bugs.
You can find attached the configuration and data I have used.
Hi David, thanks for looking at this, indeed some of them are bugs and there is now a proposed fix[0] you can test.
- I noticed that pwdPolicySubentry as static attribute is now deprecated. How
could we assign directly a specific policy to a user in the future?
While we're not going to stop honouring the attribute for a while, you should use the policy rules to select a policy accordingly.
- Using olcPPolicyRuleGroupAttr attribute in a scope rule generates a coredump
while OpenLDAP tries to evaluate the assigned ppolicy. (ie during user entry loading). See the configuration.
Should be fixed in the MR[0]
- I tried to configure a regex rule for assigning password policies. OpenLDAP
crashes when trying to compute the assigned ppolicy. (when searching a user entry matching the policy). Maybe I have not correctly defined the regex rule, but I found no concrete example of this in documentation or unit tests.
Should be fixed in the MR[0]
- Trying to run OpenLDAP in debug mode with TRACE level. (-d -1), whith given
configuration and data makes OpenLDAP crash at startup, with no special log. It is due to scope and regex rules, as when I remove them, OpenLDAP starts normally.
Should be fixed in the MR[0]
- For pwdRehashOnBind feature, I didn't understand the "If pwdReset is set to
"TRUE"" part in the man page. The current behaviour I observed is that when pwdReset is TRUE, the password is never rehashed. What is the intent here?
That was a typo in the manpage, it should not read "pwdReset" but pwdRehashOnBind there.
- When I try to modify a password from a user having a directly assigned
ppolicy (pwdPolicySubentry defined statically), the password is never rehashed.
Can you retest with the MR[0]?
[0]. https://git.openldap.org/openldap/openldap/-/merge_requests/925
Thanks,
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #3 from David Coutadeur david.coutadeur@gmail.com --- Hello,
Thanks for your response and for the fixes!
I'll give a look soon.
David
Le 22/09/2026 à 15:13, openldap-its@openldap.org a écrit :
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #2 from Ondřej Kuzník ondra@mistotebe.net --- On Mon, Sep 14, 2026 at 03:03:45PM +0000, openldap-its@openldap.org wrote:
Hello,
I have tested recently the new ppolicy features of OpenLDAP 2.7.1.
Thanks for this great work! The new features sound really exciting.
Nevertheless, I have encountered some issues during testing. As these are new features, I don't know if this is a misconfiguration problem coming from me, or if there are bugs.
You can find attached the configuration and data I have used.
Hi David, thanks for looking at this, indeed some of them are bugs and there is now a proposed fix[0] you can test.
- I noticed that pwdPolicySubentry as static attribute is now deprecated. How
could we assign directly a specific policy to a user in the future?
While we're not going to stop honouring the attribute for a while, you should use the policy rules to select a policy accordingly.
- Using olcPPolicyRuleGroupAttr attribute in a scope rule generates a coredump
while OpenLDAP tries to evaluate the assigned ppolicy. (ie during user entry loading). See the configuration.
Should be fixed in the MR[0]
- I tried to configure a regex rule for assigning password policies. OpenLDAP
crashes when trying to compute the assigned ppolicy. (when searching a user entry matching the policy). Maybe I have not correctly defined the regex rule, but I found no concrete example of this in documentation or unit tests.
Should be fixed in the MR[0]
- Trying to run OpenLDAP in debug mode with TRACE level. (-d -1), whith given
configuration and data makes OpenLDAP crash at startup, with no special log. It is due to scope and regex rules, as when I remove them, OpenLDAP starts normally.
Should be fixed in the MR[0]
- For pwdRehashOnBind feature, I didn't understand the "If pwdReset is set to
"TRUE"" part in the man page. The current behaviour I observed is that when pwdReset is TRUE, the password is never rehashed. What is the intent here?
That was a typo in the manpage, it should not read "pwdReset" but pwdRehashOnBind there.
- When I try to modify a password from a user having a directly assigned
ppolicy (pwdPolicySubentry defined statically), the password is never rehashed.
Can you retest with the MR[0]?
[0]. https://git.openldap.org/openldap/openldap/-/merge_requests/925
Thanks,
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #4 from David Coutadeur david.coutadeur@gmail.com --- Hello,
I have tested the patch. Most of the problems are fixed. Thanks for the quick PR!
See the details below.
- I noticed that pwdPolicySubentry as static attribute is now deprecated. How
could we assign directly a specific policy to a user in the future?
While we're not going to stop honouring the attribute for a while, you should use the policy rules to select a policy accordingly.
The approach of using the ppolicy rules and no more the static pwdPolicySubentry attribute seems ok. It's just that we don't have anymore a simple, normalized way to bind a user to a specific policy.
- Using olcPPolicyRuleGroupAttr attribute in a scope rule generates a coredump
while OpenLDAP tries to evaluate the assigned ppolicy. (ie during user entry loading). See the configuration.
Fixed successfully.
- I tried to configure a regex rule for assigning password policies. OpenLDAP
crashes when trying to compute the assigned ppolicy. (when searching a user entry matching the policy). Maybe I have not correctly defined the regex rule, but I found no concrete example of this in documentation or unit tests.
OpenLDAP does not crash anymore. However, the regex rule is never applied. See the provided config and data for an example.
I have tried this syntax:
olcPPolicyRuleObject: ^uid=([^,]+),ou=people,ou=([^,]+),dc=my-domain,dc=com$ olcPPolicyRulePolicy: cn=$2,ou=ppolicies,dc=my-domain,dc=com
and this one:
olcPPolicyRuleObject: "^uid=([^,]+),ou=people,ou=([^,]+),dc=my-domain,dc=com$" olcPPolicyRulePolicy: cn=$2,ou=ppolicies,dc=my-domain,dc=com
and this one:
olcPPolicyRuleObject: dn.regex="^uid=([^,]+),ou=people,ou=([^,]+),dc=my-domain,dc=com$" olcPPolicyRulePolicy: cn=$2,ou=ppolicies,dc=my-domain,dc=com
without success. The 2 last syntaxes make my user entry binded to the default ppolicy, whereas the 1st one makes the user entry to have no attribute pwdPolicySubentry.
- Trying to run OpenLDAP in debug mode with TRACE level. (-d -1), whith given
configuration and data makes OpenLDAP crash at startup, with no special log. It is due to scope and regex rules, as when I remove them, OpenLDAP starts normally.
Fixed successfully.
- For pwdRehashOnBind feature, I didn't understand the "If pwdReset is set to
"TRUE"" part in the man page. The current behaviour I observed is that when pwdReset is TRUE, the password is never rehashed. What is the intent here?
That was a typo in the manpage, it should not read "pwdReset" but pwdRehashOnBind there.
Fixed successfully.
- When I try to modify a password from a user having a directly assigned
ppolicy (pwdPolicySubentry defined statically), the password is never rehashed.
Fixed successfully.
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #5 from Ondřej Kuzník ondra@mistotebe.net --- On Fri, Sep 25, 2026 at 04:09:51PM +0000, openldap-its@openldap.org wrote:
OpenLDAP does not crash anymore. However, the regex rule is never applied. See the provided config and data for an example.
I have tried this syntax:
olcPPolicyRuleObject: ^uid=([^,]+),ou=people,ou=([^,]+),dc=my-domain,dc=com$ olcPPolicyRulePolicy: cn=$2,ou=ppolicies,dc=my-domain,dc=com
and this one:
olcPPolicyRuleObject: "^uid=([^,]+),ou=people,ou=([^,]+),dc=my-domain,dc=com$" olcPPolicyRulePolicy: cn=$2,ou=ppolicies,dc=my-domain,dc=com
and this one:
olcPPolicyRuleObject: dn.regex="^uid=([^,]+),ou=people,ou=([^,]+),dc=my-domain,dc=com$" olcPPolicyRulePolicy: cn=$2,ou=ppolicies,dc=my-domain,dc=com
without success. The 2 last syntaxes make my user entry binded to the default ppolicy, whereas the 1st one makes the user entry to have no attribute pwdPolicySubentry.
Hi David, thanks for testing, for this one you need 'olcPPolicyRuleScope: expand' to tell openldap to expand the policy string using the regex matches, I have fixed that but forgot to add the documentation parts for this and olcPPolicyRuleGroupScope. I'll add then soon.
Regards,
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #6 from David Coutadeur david.coutadeur@gmail.com ---
Hi David, thanks for testing, for this one you need 'olcPPolicyRuleScope: expand' to tell openldap to expand the policy string using the regex matches, I have fixed that but forgot to add the documentation parts for this and olcPPolicyRuleGroupScope. I'll add then soon.
Regards,
Thank you for the hint. With 'olcPPolicyRuleScope: expand', everything is working as expected!
https://bugs.openldap.org/show_bug.cgi?id=10589
Howard Chu hyc@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution|--- |TEST
--- Comment #7 from Howard Chu hyc@openldap.org --- https://git.openldap.org/openldap/openldap/-/merge_requests/925 and https://git.openldap.org/openldap/openldap/-/merge_requests/930
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #8 from Quanah Gibson-Mount quanah@openldap.org --- head:
• 91856f0a by Ondřej Kuzník at 2026-09-24T18:21:32+00:00 ITS#10589 slapo-ppolicy: Do not try to log operation on startup when there is none
• 3cfaa549 by Ondřej Kuzník at 2026-09-24T18:21:32+00:00 ITS#10589 slapo-ppolicy: Plug config-time leaks
• e81e6593 by Ondřej Kuzník at 2026-09-24T18:21:32+00:00 ITS#10589 slapo-ppolicy: Do not preempt idle-time check when no pwdLastSuccess
• 3dd6a900 by Ondřej Kuzník at 2026-09-24T18:21:32+00:00 ITS#10589 slapo-ppolicy: Store a reference to member/groupOfNames
• 0d4ed03a by Ondřej Kuzník at 2026-09-24T18:21:32+00:00 ITS#10589 slapo-ppolicy: Fix cn=config handling
• 85ccd409 by Ondřej Kuzník at 2026-09-24T18:21:32+00:00 ITS#10589 slapo-ppolicy: Fix backend_group usage
• e1faf5dc by Ondřej Kuzník at 2026-09-24T18:21:32+00:00 ITS#10589 slapo-ppolicy: fix typo
• db1317eb by Ondřej Kuzník at 2026-09-30T03:16:51+00:00 ITS#10589 slapo-ppolicy: fix parsing/cn=config conversion
• 867a0bcf by Ondřej Kuzník at 2026-09-30T03:16:51+00:00 ITS#10589 slapo-ppolicy: Fix continue rule handling vs. default rules
• 4a204973 by Ondřej Kuzník at 2026-09-30T03:16:51+00:00 ITS#10589 slapo-ppolicy: Also rehash on pwmod extop if appropriate
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #9 from Quanah Gibson-Mount quanah@openldap.org --- RE27:
021c94f7 by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: Do not try to log operation on startup when there is none
https://bugs.openldap.org/show_bug.cgi?id=10589
--- Comment #10 from Quanah Gibson-Mount quanah@openldap.org --- RE27:
7e85b722 by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: Plug config-time leaks
d79ea85f by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: Do not preempt idle-time check when no pwdLastSuccess
e6e57501 by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: Store a reference to member/groupOfNames
c3a30194 by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: Fix cn=config handling
b4596bd8 by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: Fix backend_group usage
d8a24ff7 by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: fix typo
7cd31140 by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: fix parsing/cn=config conversion
48397108 by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: Fix continue rule handling vs. default rules
0dfd5fae by Ondřej Kuzník at 2026-10-01T23:33:13+00:00
ITS#10589 slapo-ppolicy: Also rehash on pwmod extop if appropriate
-
openldap-its＠openldap.org