RE: How to assign a password policy to a group of users, in one go

No… it’s usage of ‘groups’ doesn’t imply the functional groups but rather a collection of ‘x’ users.

However, http://www.openldap.org/doc/admin24/overlays.html section 12.10.2 states: “2. Default password policy - If there is no specific pwdPolicySubentry set for an object, and the password policy module was configured with the DN of a default policy object and if that object exists, then the policy defined in that object is applied.“

It includes a link to symas blog – (dead link really, but search for ppolicy loads a page that includes: ppolicy_default "cn=default,ou=Policies,dc=symas,dc=com"

You can also try googling for “openldap ppolicy default”.

- chris

From: openldap-technical-bounces@OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Rodrigo Coutinho Sent: Tuesday, February 25, 2014 9:02 AM To: Clément OUDOT Cc: openldap-technical@openldap.org Subject: RE: How to assign a password policy to a group of users, in one go

The slapo-ppolicy states that "...Different groups of users may be associated with different password policies, and there is no limit ..."

Don't those "groups" mentioned, refer to groups of ldap users cn=xxx,ou=groups,... ?

________________________________ De: Clément OUDOT [mailto:clem.oudot@gmail.com] Enviada: terça-feira, 25 de Fevereiro de 2014 16:34 Para: Rodrigo Coutinho Cc: openldap-technical@openldap.org Assunto: Re: How to assign a password policy to a group of users, in one go

2014-02-25 17:10 GMT+01:00 Rodrigo Coutinho <Rodrigo.Coutinho@ifap.ptmailto:Rodrigo.Coutinho@ifap.pt>:

Hi again,

I've finally managed to setup the password policy, but only statically (ran configure again).

Have defined two password policies, one for all (default) and another for a specific group of users.

The question now is: Can I assign a password policy to a group of users (cn=some_group,ou=groups,dc=xxx,dc=local)in one go, or must I assign to each user individualy the pwdPolicySubentry?

I have searched, and although slapo states that it can be done, no example is provided.

You need to assign to each user. Clément. ________________________________ A transmissão de mensagens por e-mail não é absolutamente segura ou livre de erros. A mensagem pode ser intercetada, alterada, perdida, destruída, chegar ao destinatário com atraso, ou mesmo com vírus, não obstante o IFAP utilizar software anti-vírus. Esta mensagem, incluindo eventuais ficheiros anexos, pode conter informação confidencial ou privilegiada e destina-se a uso exclusivo dos seus destinatários. Se não for o destinatário pretendido, informamos que a recebeu por engano, pelo que, qualquer utilização, distribuição, reencaminhamento ou outra forma de revelação a terceiros, impressão ou cópia são expressamente proibidos. Se recebeu esta mensagem por engano, por favor contacte imediatamente o remetente por e-mail, e apague de imediato a mensagem do seu sistema informático. O IFAP declina qualquer responsabilidade por erros ou omissões na presente mensagem e eventuais consequências, que resultem das situações referidas.

________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.