I'm looking for a solution allowing to lock user accounts stored in
LDAP, whatever kind of client using LDAP for autenticating (the same as
shadowAccount class allows, but only for PAM. Buchan suggested me to try
to use ppolicy overlay.
I'm not really interested in what seems to be the main goal of password
policy: as I'm importing passwords automatically from another LDAP
system, that's not the right place to impose constraints on them. So my
main interest is in operational attribute pwdAccountLockedTime,
described in slapo-ppolicy: if set to 0, the user should not be able to
So, I set up a very minimal default password policy object, as it seems
to be quite mandatory:
Then I tried to add a pwdAccountLockedTime attribute to a user:
Error: pwdAccountLockedTime: value #0 invalid per syntax
Then I read the schema, additionaly to the man page, and I found
additional (and potentially contradictory information), such as using
something described a subtype to declaring which password attribute is
really affected, and I tried:
Error: additional info: pwdAccountLockedTime;pwd-userPassword:
operational attribute with options undefined
Additionaly, I found the definition of those operational attributes were
commented in the schema file...
So, here is a list of questions I can't find a valid answer for:
1) do you need a policy entry if you're only interested in user entries
operational attributes ?
According to the man page, yes: If there is no specific policy for
an entry and no default is given, then no policies will be enforced
2) do you need to add a new class to users account to be able to use
those additional operational attributes, or just loading the overlay is
According to examples found in thread
3) does the definition of those attributes need to exist in the schema
(thus uncommented) or are they defined in the overlay ?
4) which is right between the man page or the schema comment for the
attribute name (pwdAccountLockedTime vs
pwdAccountLockedTime;pwd-userPassword) and the value to lock an account
(0 vs 000001010000Z)
As the comments seems to comes from the RFC directly, I'd rather trust
the man page, but i've been unsucessful with both...
If it matters, i'm using openldap-servers-2.3.27 on mandriva linux 2007.0.
Moyens Informatiques - INRIA Futurs
Tel: 01 69 35 69 62