HI!
I'm using back-sock as overlay to intercept bind *requests* and send them to an external listener which returns success(0) or invalidCredentials(49).
I'd like to avoid having to deal with operational attributes in the user's entry. Therefore in case of invalidCredentials(49) I'd like slapo-ppolicy to add attribute value to 'pwdFailureTime'.
The order of overlays in slapd.conf is:
overlay sock sockops bind
overlay ppolicy
overlay lastbind
overlay rwm
From my understand the requests go from bottom up
rwm -> lastbind -> ppolicy -> back-sock .....continue...... returns success(0) or invalidCredentials(49)
and vice versa the response go through
back-sock -> ppolicy -> lastbind -> rwm
It partially works:
(/) I see update of 'authTimestamp' by slapo-lastbind.
(/) If back-sock listener returns success(0) slapo-ppolicy correctly checks password expiry in the response chain and returns invalidCredentials(49) with appropriate ppolicy response controls.
(x) But the attribute 'pwdFailureTime' is not set in case back-sock listener returns invalidCredentials(49).
Reading source of ppolicy_bind_response() one of the first things is to check for rs->sr_err == LDAP_INVALID_CREDENTIALS and add another 'pwdFailureTime' value.
So it should work. But it doesn't. Any clue what I'm doing wrong?
Ciao, Michael.