Hello,
I have two issues. One is I gave myself redundant *ppolicy* overlays I can't delete. The other is I don't know why I can not reset a user's password.
The first is that in a rush, late at night, I ended up with multiple (duplicate) Password Policy Overlays. I went back and tried to delete these, but:
$ *sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///* dn: olcOverlay={5}ppolicy,olcDatabase={1}hdb,cn=config changetype: delete deleting entry "olcOverlay={5}ppolicy,olcDatabase={1}hdb,cn=config" ldap_delete: Server is unwilling to perform (53)
It looks like this is a known consideration, per http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-overlays and that I'll have to cowboy the server config to get the redundant overlays removed.
root@ldap0:~# *slapd -V* @(#) $OpenLDAP: slapd (Ubuntu) (May 31 2017 21:52:16) $ buildd@lgw01-30 :/build/openldap-tnOaja/openldap-2.4.31/debian/build/servers/slapd
Okay, so what is that overlay? Pretty simple stuff:
dn: olcOverlay={2}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {2}ppolicy olcPPolicyDefault: cn=passwordDefault,ou=Policies,dc=qxxxxxxxxd,dc=com olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: FALSE
(But defined four times ... {2..5})
What is the problem, then? The problem is I can not set a user's password.
root@ldap0:~# */usr/bin/ldappasswd -y /etc/ldapscripts/ldapscripts.passwd -D cn=admin,dc=qxxxxxxxxd,dc=com -x -H ldap://localhost -T /tmp/ldapsetpasswd uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com* Result: No such attribute (16)
Say what?
dn: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com structuralObjectClass: account entryUUID: cd55cc80-f8a5-1037-976e-9da738d41e24 creatorsName: cn=admin,dc=qxxxxxxxxd,dc=com createTimestamp: 20180530223739Z pwdFailureTime: 20180530223741Z pwdFailureTime: 20180530224243Z pwdFailureTime: 20180530224244Z pwdFailureTime: 20180530224306Z pwdFailureTime: 20180530224307Z pwdFailureTime: 20180530224354Z pwdFailureTime: 20180530224538Z pwdFailureTime: 20180530224541Z entryCSN: 20180530224541.157285Z#000000#000#000000 modifiersName: cn=admin,dc=qxxxxxxxxd,dc=com modifyTimestamp: 20180530224541Z entryDN: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com subschemaSubentry: cn=Subschema hasSubordinates: FALSE
Maybe the user is locked out?
root@ldap0:~# *ldapmodify -Q -Y EXTERNAL -H ldapi:/// -D cn=admin,dc=qxxxxxxxxd,dc=com* dn: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com changetype: modify delete: pwdFailureTime modifying entry "uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com" ldap_modify: Constraint violation (19) additional info: pwdFailureTime: no user modification allowed
Q1: Any bright idea on removing the redundant ppolicy overlays?
Q2: Any bright idea on what's up with resetting zachary's password?
Thanks, -danny