From kumarchandeshwar99@gmail.com Tue Feb 15 00:45:27 2022
From: Chandeshwar Mishra <kumarchandeshwar99@gmail.com>
To: openldap-technical@openldap.org
Subject: Re: How to restrict access to pwdHistory attributes
Date: Tue, 15 Feb 2022 03:56:35 +0530
Message-ID:
 <CAHecg0nmvzBkcfs7uDbYKU2R4QE+ok=5WKSB24Hxf8aAsBZZPw@mail.gmail.com>
In-Reply-To: <5DB120E21F27075FF7BDF544@192.168.1.12>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8257070714882019713=="

--===============8257070714882019713==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Hi Quanah,

Thanks for your response.  Our setup is a very old one and we are planning
to migrate it to the latest stable version but Since this openldap is
deployed in Production
it is not possible for us to upgrade it suddenly.

As you mentioned that ppolicy schema is missing in configuration, so is it
possible that without having ppolicy schema, Openldap will remember the
pwdHistory of the user ?

In my case pwdHistory is visible to users, for which I want to apply ACL so
that a user can only see his/her pwdHistory , not other users pwdHistory.

Below are my configuration related to ppolicy configuration in config file:-

include         /etc/openldap/schema/ppolicy.schema
--- more include directive related to schema

----
moduleload ppolicy.la
moduleload memberof.la
overlay memberof
overlay syncprov
overlay auditlog
#overlay accesslog
overlay ppolicy
ppolicy_default "cn=passwordDefault,dc=example,dc=com"

Thanks & Regards,
Chandeshwar Kumar





On Mon, Feb 14, 2022 at 11:24 PM Quanah Gibson-Mount <quanah(a)fast-mail.org>
wrote:

>
>
> --On Saturday, February 12, 2022 5:22 AM +0000
> kumarchandeshwar99(a)gmail.com
> wrote:
>
> > Hi,
> >  I am trying to restrict access to pwdHistory attributes provided by
> > ppolicy overlay. I have applied the below ACL
> >
> > access to attrs=pwdHistory
> >      by * none
> >  but while doing slaptest,  its throwing below error:-
> > /etc/openldap/slapd.conf: line 212: unknown attr "pwdHistory" in to
> clause
> > <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control>
> > ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>]
> > [attrs=<attrspec>] <attrspec> ::= <attrname>
> > [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::=
> > <attr> [ , <attrlist> ]
> > <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry |
> children
> > <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ]
> >         [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN>
> ]
> >         [dnattr=<attrname>]
> >         [realdnattr=<attrname>]
> >         [group[/<objectclass>[/<attrname>]][.<style>]=<group>]
> >         [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>]
> >         [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>]
> >         [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]
> >
> > Before posting here I searched archive and found one similar, issue , but
> > it did not resolve my issue. I have running openldap-servers-2.4.23 on
> > RHEL-6.5.
>
> You are missing the ppolicy schema in your configuration.
>
> However, I would note that both RHEL6 and OpenLDAP 2.4 are historic and no
> longer in support.  I'd strongly advise upgrading to both an OS that is
> under support and a version of OpenLDAP that's under support.
>
> Regards,
> Quanah
>
>
>
>



--===============8257070714882019713==
Content-Type: text/html
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.htm"
MIME-Version: 1.0

PGRpdiBkaXI9Imx0ciI+SGkgUXVhbmFoLDxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzIGZvciB5
b3VyIHJlc3BvbnNlLsKgIE91ciBzZXR1cCBpcyBhIHZlcnkgb2xkIG9uZSBhbmQgd2UgYXJlIHBs
YW5uaW5nIHRvIG1pZ3JhdGUgaXQgdG8gdGhlIGxhdGVzdCBzdGFibGUgdmVyc2lvbiBidXQgU2lu
Y2UgdGhpcyBvcGVubGRhcCBpcyBkZXBsb3llZCBpbiBQcm9kdWN0aW9uPC9kaXY+PGRpdj5pdCBp
cyBub3QgcG9zc2libGUgZm9yIHVzIHRvIHVwZ3JhZGUgaXQgc3VkZGVubHkuPC9kaXY+PGRpdj48
YnI+PC9kaXY+PGRpdj5BcyB5b3UgbWVudGlvbmVkIHRoYXQgcHBvbGljecKgc2NoZW1hIGlzIG1p
c3NpbmcgaW4gY29uZmlndXJhdGlvbiwgc28gaXMgaXQgcG9zc2libGUgdGhhdCB3aXRob3V0IGhh
dmluZyBwcG9saWN5IHNjaGVtYSwgT3BlbmxkYXAgd2lsbCByZW1lbWJlciB0aGUgcHdkSGlzdG9y
eSBvZiB0aGUgdXNlciA/PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5JbiBteSBjYXNlIHB3ZEhp
c3RvcnkgaXMgdmlzaWJsZSB0byB1c2VycywgZm9yIHdoaWNoIEkgd2FudCB0byBhcHBseSBBQ0wg
c28gdGhhdCBhIHVzZXIgY2FuIG9ubHkgc2VlIGhpcy9oZXIgcHdkSGlzdG9yeSAsIG5vdCBvdGhl
ciB1c2VycyBwd2RIaXN0b3J5LjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+QmVsb3cgYXJlIG15
IGNvbmZpZ3VyYXRpb24gcmVsYXRlZCB0byBwcG9saWN5wqBjb25maWd1cmF0aW9uIGluIGNvbmZp
ZyBmaWxlOi08L2Rpdj48ZGl2Pjxicj5pbmNsdWRlIMKgIMKgIMKgIMKgIC9ldGMvb3BlbmxkYXAv
c2NoZW1hL3Bwb2xpY3kuc2NoZW1hPGJyPjwvZGl2PjxkaXY+LS0tIG1vcmUgaW5jbHVkZSBkaXJl
Y3RpdmUgcmVsYXRlZCB0byBzY2hlbWE8L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pi0tLS08L2Rp
dj48ZGl2Pm1vZHVsZWxvYWQgPGEgaHJlZj0iaHR0cDovL3Bwb2xpY3kubGEiPnBwb2xpY3kubGE8
L2E+PGJyPm1vZHVsZWxvYWQgPGEgaHJlZj0iaHR0cDovL21lbWJlcm9mLmxhIj5tZW1iZXJvZi5s
YTwvYT48YnI+b3ZlcmxheSBtZW1iZXJvZjxicj5vdmVybGF5IHN5bmNwcm92PGJyPm92ZXJsYXkg
YXVkaXRsb2c8YnI+I292ZXJsYXkgYWNjZXNzbG9nPGJyPm92ZXJsYXkgcHBvbGljeTxicj5wcG9s
aWN5X2RlZmF1bHQgJnF1b3Q7Y249cGFzc3dvcmREZWZhdWx0LGRjPWV4YW1wbGUsZGM9Y29tJnF1
b3Q7PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzICZhbXA7wqBSZWdhcmRzLDwv
ZGl2PjxkaXY+Q2hhbmRlc2h3YXIgS3VtYXI8L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pjxicj48
L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48L2Rpdj48YnI+PGRpdiBjbGFzcz0i
Z21haWxfcXVvdGUiPjxkaXYgZGlyPSJsdHIiIGNsYXNzPSJnbWFpbF9hdHRyIj5PbiBNb24sIEZl
YiAxNCwgMjAyMiBhdCAxMToyNCBQTSBRdWFuYWggR2lic29uLU1vdW50ICZsdDs8YSBocmVmPSJt
YWlsdG86cXVhbmFoQGZhc3QtbWFpbC5vcmciPnF1YW5haEBmYXN0LW1haWwub3JnPC9hPiZndDsg
d3JvdGU6PGJyPjwvZGl2PjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1h
cmdpbjowcHggMHB4IDBweCAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQgcmdiKDIwNCwyMDQs
MjA0KTtwYWRkaW5nLWxlZnQ6MWV4Ij48YnI+Cjxicj4KLS1PbiBTYXR1cmRheSwgRmVicnVhcnkg
MTIsIDIwMjIgNToyMiBBTSArMDAwMCA8YSBocmVmPSJtYWlsdG86a3VtYXJjaGFuZGVzaHdhcjk5
QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmt1bWFyY2hhbmRlc2h3YXI5OUBnbWFpbC5jb208
L2E+IDxicj4Kd3JvdGU6PGJyPgo8YnI+CiZndDsgSGksPGJyPgomZ3Q7wqAgSSBhbSB0cnlpbmcg
dG8gcmVzdHJpY3QgYWNjZXNzIHRvIHB3ZEhpc3RvcnkgYXR0cmlidXRlcyBwcm92aWRlZCBieTxi
cj4KJmd0OyBwcG9saWN5IG92ZXJsYXkuIEkgaGF2ZSBhcHBsaWVkIHRoZSBiZWxvdyBBQ0w8YnI+
CiZndDs8YnI+CiZndDsgYWNjZXNzIHRvIGF0dHJzPXB3ZEhpc3Rvcnk8YnI+CiZndDvCoCDCoCDC
oCBieSAqIG5vbmU8YnI+CiZndDvCoCBidXQgd2hpbGUgZG9pbmcgc2xhcHRlc3QswqAgaXRzIHRo
cm93aW5nIGJlbG93IGVycm9yOi08YnI+CiZndDsgL2V0Yy9vcGVubGRhcC9zbGFwZC5jb25mOiBs
aW5lIDIxMjogdW5rbm93biBhdHRyICZxdW90O3B3ZEhpc3RvcnkmcXVvdDsgaW4gdG8gY2xhdXNl
PGJyPgomZ3Q7ICZsdDthY2Nlc3MgY2xhdXNlJmd0OyA6Oj0gYWNjZXNzIHRvICZsdDt3aGF0Jmd0
OyBbIGJ5ICZsdDt3aG8mZ3Q7IFsgJmx0O2FjY2VzcyZndDsgXSBbICZsdDtjb250cm9sJmd0Ozxi
cj4KJmd0OyBdIF0rICZsdDt3aGF0Jmd0OyA6Oj0gKiB8IGRuWy4mbHQ7ZG5zdHlsZSZndDs9Jmx0
O0ROJmd0O10gW2ZpbHRlcj0mbHQ7ZmlsdGVyJmd0O108YnI+CiZndDsgW2F0dHJzPSZsdDthdHRy
c3BlYyZndDtdICZsdDthdHRyc3BlYyZndDsgOjo9ICZsdDthdHRybmFtZSZndDs8YnI+CiZndDsg
W3ZhbFsvJmx0O21hdGNoaW5nUnVsZSZndDtdWy4mbHQ7YXR0cnN0eWxlJmd0O109Jmx0O3ZhbHVl
Jmd0O10gfCAmbHQ7YXR0cmxpc3QmZ3Q7ICZsdDthdHRybGlzdCZndDsgOjo9PGJyPgomZ3Q7ICZs
dDthdHRyJmd0OyBbICwgJmx0O2F0dHJsaXN0Jmd0OyBdPGJyPgomZ3Q7ICZsdDthdHRyJmd0OyA6
Oj0gJmx0O2F0dHJuYW1lJmd0OyB8IEAmbHQ7b2JqZWN0Q2xhc3MmZ3Q7IHwgISZsdDtvYmplY3RD
bGFzcyZndDsgfCBlbnRyeSB8IGNoaWxkcmVuPGJyPgomZ3Q7ICZsdDt3aG8mZ3Q7IDo6PSBbICog
fCBhbm9ueW1vdXMgfCB1c2VycyB8IHNlbGYgfCBkblsuJmx0O2Ruc3R5bGUmZ3Q7XT0mbHQ7RE4m
Z3Q7IF08YnI+CiZndDvCoCDCoCDCoCDCoCDCoFsgcmVhbGFub255bW91cyB8IHJlYWx1c2VycyB8
IHJlYWxzZWxmIHwgcmVhbGRuWy4mbHQ7ZG5zdHlsZSZndDtdPSZsdDtETiZndDsgXTxicj4KJmd0
O8KgIMKgIMKgIMKgIMKgW2RuYXR0cj0mbHQ7YXR0cm5hbWUmZ3Q7XTxicj4KJmd0O8KgIMKgIMKg
IMKgIMKgW3JlYWxkbmF0dHI9Jmx0O2F0dHJuYW1lJmd0O108YnI+CiZndDvCoCDCoCDCoCDCoCDC
oFtncm91cFsvJmx0O29iamVjdGNsYXNzJmd0O1svJmx0O2F0dHJuYW1lJmd0O11dWy4mbHQ7c3R5
bGUmZ3Q7XT0mbHQ7Z3JvdXAmZ3Q7XTxicj4KJmd0O8KgIMKgIMKgIMKgIMKgW3BlZXJuYW1lWy4m
bHQ7cGVlcm5hbWVzdHlsZSZndDtdPSZsdDtwZWVyJmd0O10gW3NvY2tuYW1lWy4mbHQ7c3R5bGUm
Z3Q7XT0mbHQ7bmFtZSZndDtdPGJyPgomZ3Q7wqAgwqAgwqAgwqAgwqBbZG9tYWluWy4mbHQ7ZG9t
YWluc3R5bGUmZ3Q7XT0mbHQ7ZG9tYWluJmd0O10gW3NvY2t1cmxbLiZsdDtzdHlsZSZndDtdPSZs
dDt1cmwmZ3Q7XTxicj4KJmd0O8KgIMKgIMKgIMKgIMKgW3NzZj0mbHQ7biZndDtdIFt0cmFuc3Bv
cnRfc3NmPSZsdDtuJmd0O10gW3Rsc19zc2Y9Jmx0O24mZ3Q7XSBbc2FzbF9zc2Y9Jmx0O24mZ3Q7
XTxicj4KJmd0Ozxicj4KJmd0OyBCZWZvcmUgcG9zdGluZyBoZXJlIEkgc2VhcmNoZWQgYXJjaGl2
ZSBhbmQgZm91bmQgb25lIHNpbWlsYXIsIGlzc3VlICwgYnV0PGJyPgomZ3Q7IGl0IGRpZCBub3Qg
cmVzb2x2ZSBteSBpc3N1ZS4gSSBoYXZlIHJ1bm5pbmcgb3BlbmxkYXAtc2VydmVycy0yLjQuMjMg
b248YnI+CiZndDsgUkhFTC02LjUuPGJyPgo8YnI+CllvdSBhcmUgbWlzc2luZyB0aGUgcHBvbGlj
eSBzY2hlbWEgaW4geW91ciBjb25maWd1cmF0aW9uLjxicj4KPGJyPgpIb3dldmVyLCBJIHdvdWxk
IG5vdGUgdGhhdCBib3RoIFJIRUw2IGFuZCBPcGVuTERBUCAyLjQgYXJlIGhpc3RvcmljIGFuZCBu
byA8YnI+CmxvbmdlciBpbiBzdXBwb3J0LsKgIEkmIzM5O2Qgc3Ryb25nbHkgYWR2aXNlIHVwZ3Jh
ZGluZyB0byBib3RoIGFuIE9TIHRoYXQgaXMgPGJyPgp1bmRlciBzdXBwb3J0IGFuZCBhIHZlcnNp
b24gb2YgT3BlbkxEQVAgdGhhdCYjMzk7cyB1bmRlciBzdXBwb3J0Ljxicj4KPGJyPgpSZWdhcmRz
LDxicj4KUXVhbmFoPGJyPgo8YnI+Cjxicj4KPGJyPgo8L2Jsb2NrcXVvdGU+PC9kaXY+Cg==

--===============8257070714882019713==--