Re: exempt some users from OpenLDAP password policy

Dear All,

How can we disable password policy completely?

Thanks, Tayyab Saeed ----- Original Message -----

From: "Dave Macias" davama@gmail.com To: "Tayyab Saeed" tayyab.saeed@nds.com.pk Cc: openldap-technical@openldap.org, "Matthieu Cerda" matthieu.cerda@nbs-system.com Sent: Thursday, April 19, 2018 5:36:04 PM Subject: Re: exempt some users from OpenLDAP password policy

What your ldap tree look like (the relevant parts, users, current ppolicy)?

As far as links, there are soo many out there. Just search for one that fits your enviroment Here is how to add a ppolicy in the first place. https://wiki.polaire.nl/doku.php?id=centos7_openldap_ppolicy

How to add ppolicy to specific objects: http://www.zytrax.com/books/ldap/ch6/ppolicy.html#examples

As Matthieu already mentioned, assuming you already have a ppolicy, then you would need to create a less restrictive policy and apply to specific users using the pwdPolicySubentry attribute

regards, dave

On Apr 15, 2018, 11:50 PM -0400, Tayyab Saeed < tayyab.saeed@nds.com.pk >, wrote:

Dear All,

I am sorry but still unable to configure the same, could anyone please share the complete steps / link so i can setup the same.

Thanks, Tayyab Saeed

From: "Dave Macias" < davama@gmail.com > To: "Matthieu Cerda" < matthieu.cerda@nbs-system.com > Cc: openldap-technical@openldap.org Sent: Friday, April 13, 2018 8:27:04 PM Subject: Re: exempt some users from OpenLDAP password policy

Here is an example which you can apply per-user which needs to be exempted:

dn: cn=ppolicy-exclude,ou=policies,dc=organization,dc=org cn: ppolicy-exclude objectClass: top objectClass: device objectClass: pwdPolicyChecker objectClass: pwdPolicy pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdMustChange: FALSE pwdLockout: FALSE

On Fri, Apr 13, 2018 at 10:28 AM, Matthieu Cerda < matthieu.cerda@nbs-system.com > wrote:

<blockquote>

Hello,

You may either:

* Set a relaxed default password policy using olcPPolicyDefault / ppolicy_default (or no default policy at all) and set more restrictive password policies on some of your users by setting the pwdPolicySubentry attribute on their object * Set a restrictive default password policy, and a relaxed ones on some of your users

Using one or the other depends on the proportions of exceptions you would generate: the less, the better