Dear sir,

I found that the account policy can't be replicated in openldap 2.4.8

I setup 2 servers, with Mirror mode. Then, I added the password policy and some user accounts in server 1, I then startup server 2, the user accounts are replicated to server 2.

Content of policy.ldif :
dn: ou=Policies
ou: Policies
description: All people in organisation
objectClass: organizationalUnit

dn: ou=Policies,o=HKSARG
ou: Policies
description: All people in organisation
objectClass: organizationalUnit

dn: cn=default,ou=Policies,o=HKSARG
objectClass: top
objectClass: device
objectClass: pwdPolicy
cn: default
pwdAttribute: userPassword
pwdMaxFailure: 3
pwdInHistory: 12
pwdMinLength: 6
pwdExpireWarning: 259200
pwdAllowUserChange: TRUE
pwdFailureCountInterval: 300
pwdGraceAuthNLimit: 1
pwdLockoutDuration: 300
pwdMustChange: FALSE
pwdCheckQuality: 1
pwdMaxAge: 60000000

slapd.conf in server 1 :

#overlay syncprov
overlay ppolicy
ppolicy_default "cn=default,ou=Policies,o=HKSARG"
overlay syncprov

#access to * by dn="cn=Manager" write by * read
access to * by * write
access to * by * read
#database monitor
syncprov-checkpoint 100 10
syncprov-sessionlog 100

# syncrepl directives
syncrepl      rid=1
              provider=ldap://202.245.193.128:389/
              bindmethod=simple
              binddn="cn=Manager"
              credentials=secret
              searchbase="o=HKSARG"
              schemachecking=off
              type=refreshAndPersist
              retry="60 +"

syncrepl      rid=2
              provider=ldap://10.166.23.218:389/
              bindmethod=simple
              binddn="cn=Manager"
              credentials=secret
              searchbase="o=HKSARG"
              schemachecking=off
              type=refreshAndPersist
              retry="60 +"

mirrormode on
serverID   1

slapd.conf in server 2 :

# Password policy
overlay ppolicy
ppolicy_default "cn=default,ou=Policies,o=HKSARG"

overlay syncprov
#access to * by dn="cn=Manager" write by * read
access to * by * write
access to * by * read

#database monitor
syncprov-checkpoint 100 10
syncprov-sessionlog 100

# syncrepl directives
syncrepl      rid=1
              provider=ldap://202.245.193.128:389/
              bindmethod=simple
              binddn="cn=Manager"
              credentials=secret
              searchbase="o=HKSARG"
              schemachecking=off
              type=refreshAndPersist
              retry="60 +"

syncrepl      rid=2
              provider=ldap://10.166.23.218:389/
              bindmethod=simple
              binddn="cn=Manager"
              credentials=secret
              searchbase="o=HKSARG"
              schemachecking=off
              type=refreshAndPersist
              retry="60 +"

mirrormode on
serverID    2

I input the incorrect password 3 times in server 1 for a user, then, I find that the attribute pwdAccountLockedTime is updated in server 1, but I find that in server 2, this attribute is not replicated. As I result, when I input correct password in server 2, I still get authentication successful, but in server 1, authentication is failed.

Thanks

Confidential Communication - This e-mail (including any attachments) is confidential and may be 
legally privileged. If this e-mail has been sent to you by mistake please inform us by reply 
e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the 
information in it.