Achilleas Mantzios wrote:
I have managed successfully to setup a fully functional openldap server on FreeBSD.
So far, I had success with : ppolicy, ACLs, legacy SQL exposed as LDAP, SASL
My only problem thus far is combining SASL with ppolicy. When binding with classic
authentication using -D dn, then ppolicy overlay has the expected effect.
However when using SASL (SASL/SCRAM-SHA-1) with -U, while it works correctly converting
uid to DN
with authz-regexp, it does not seem to look for ppolicy (default or derived from
Moreover, enforced violations of ppolicy (e.g. failed attempted authentications >=
when done via SASL seem to have no effect on ppolicy attributes, e.g.
while they work fine when binding with simple authentication.
Is there any way to overcome this? Or is ppolicy honored only via simple DN binds?
ppolicy is only honored by Simple Binds. There was some discussion, a long
time ago, about how to make SASL use/recognize LDAP password policy, but it
never went anywhere.
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/