I did check in the bugtracker and found these 2 bugs:
http://www.openldap.org/its/index.cgi/Incoming?id=7262;expression=ppolicy;pa...
http://www.openldap.org/its/index.cgi/Incoming?id=7788;expression=ppolicy;pa...
it feels like those can be the cause of my problem. Is there a way to ping a developer to have a look at them it looks like they are quite old and they have no responses.
/Mikael
On 2014-02-06 13:37, Mikael Nehlsen wrote:
Hello!
I have a problem with the ppolicy module. I have 2 ldaptrees dc=example,dc=com and o=external and I want to have password policies (lockout after 5 failed login attempts) and I can see that it works on dc=example,dc=com but it does not work on o=external.
Both trees save failed login attempts but only the first tree locks people out o=external just saves more and more failed attempts but never lockout the user.
I have tried a lot of things and I can not figure out what the problem is. I hope someone here can help me.
It is 2 replicated ubuntu 10.04 servers with openldap 2.4.21-0ubuntu5.7 and the ppolicy configuration looks like this:
ppolmodule.ldif :
dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la
ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppolmodule.ldif -h ldap1
ppol.ldif:
dn: ou=policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: policies
dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6
ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol.ldif -h ldap1
ppol_external.ldif:
dn: ou=policies,o=external objectClass: organizationalUnit objectClass: top ou: policies
dn: cn=default,ou=policies,o=external objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6
ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol_external.ldif -h ldap1
ppoloverlay.ldif:
dn: olcOverlay=ppolicy,olcDatabase={1}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com
ppoloverlay_external.ldif:
dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,o=external
ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay.ldif -h ldap1
ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay_external.ldif -h ldap1
I tried with only one default policy for both trees as well, it made no difference.
/Mikael