On Mon, Jan 22, 2007 at 04:27:19PM -0500, Metcalf, Roger wrote:
Thanks for the quick response! I'm using 2.3.27 because it was The Stable Release when I started this. I'll move to the latest stable release after I get ppolicy figured out.
I want dynamic modules, so I changed my enable-ppolicy to be "mod" --
<snip >
In slapd.conf I set the module path:
modulepath /usr/sbin/openldap moduleload ppolicy.la
<snip> overlay ppolicy ppolicy_default "cn=Standard Policy,ou=Policies,c=us" ppolicy_hash_cleartext ppolicy_use_lockout
Still I get:
[root openldap-2.3.27]# /etc/init.d/ldap start Checking configuration files for : WARNING: No dynamic config support for overlay ppolicy. config file testing succeeded Starting slapd: FAILED [root openldap-2.3.27]#
I get this problem with 2.3.30 (debian)
when I do the same thing for unique as well.
seems like the only way to get slapd to start without coughing its guts up is
1 add the module load statement before the backend statement 2 use overlay in the database section 3 ignore the warning about dynamic configuration!
Plus I was having trouble inserting my default policy as well, until I matched it up with organizationalRole, seems like pwdPolicy did not like being with inetorgperson
Shouldn't this work now?
I attach my slapd.conf, mostly vanilla in this version, and I've removed commented lines for your convenience. How's it look?
include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/acs.schema include /etc/openldap/schema/ppolicy.schema
pidfile /var/lib/ldap/run/slapd.pid argsfile /var/lib/ldap/run/slapd.args
modulepath /usr/sbin/openldap moduleload ppolicy.la
database bdb suffix "c=US" rootdn "cn=Manager, c=US" rootpw secret
directory /var/lib/ldap/openldap-data
index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub loglevel 256
overlay ppolicy
ppolicy_default "cn=Standard Policy,ou=Policies,c=us" ppolicy_hash_cleartext ppolicy_use_lockout
Thanks, Roger
-----Original Message----- From: Quanah Gibson-Mount [mailto:quanah@stanford.edu] Sent: Monday, January 22, 2007 1:36 PM To: Metcalf, Roger; openldap-software@openldap.org Subject: Re: pesky ppolicy problems
--On Monday, January 22, 2007 1:08 PM -0500 "Metcalf, Roger" roger.metcalf@acs-inc.com wrote:
I am trying to use the ppolicy overlay. I've searched, read and experimented and can't get it to work. I've read other similar postings with similar problems but
haven't found
the one with the answer.
My OpenLDAP knowledge is intermediate.
I download 2.3.27, then build it:
Why 2.3.27? 2.3.32 is the current stable release.
Plus there have been fixes since 2.3.27:
OpenLDAP 2.3.30 Release (2006/11/14) Fixed slapo-ppolicy external quality check (ITS#4741)
OpenLDAP 2.3.29 Release (2006/11/10) Fixed slapo-ppolicy leaks (ITS#4665)
OpenLDAP 2.3.28 Release (2006/10/21) Fixed slapo-ppolicy pwdChangedTime behavior (ITS#4692)
As for your questions:
Questions:
- Where is ppolicy.la located?
Well, if its a dynamic module, then in $lib/openldap:
ldap00:/usr/local/lib/openldap> ls -l ppol* lrwxrwxrwx 1 root root 21 Nov 13 22:38 ppolicy-2.3.so.0 -> ppolicy-2.3.so.0.2.16* -rwxr-xr-x 1 root root 102169 Nov 8 21:49 ppolicy-2.3.so.0.2.16* -rwxr-xr-x 1 root root 909 Nov 8 21:49 ppolicy.la* lrwxrwxrwx 1 root root 21 Nov 13 22:38 ppolicy.so -> ppolicy-2.3.so.0.2.16*
- Does it need to be loaded?
Yes, if it is a dynamic module.
- Where is the path to it specified?
Via the "modulepath" directive in slapd.conf:
# Load dynamic backend modules: modulepath /usr/local/lib/openldap moduleload back_hdb.la moduleload back_monitor.la
- When are moduleload specs needed?
Not sure what you mean here.
- Are env variables needed to find ppolicy.la?
No.
- What's the secret?
Reading the man pages and other documentation.
- When will the book be published?
Howard is currently working on writing it.
--Quanah
-- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html