Hi Quanah,
Thanks for your response. Our setup is a very old one and we are planning to migrate it to the latest stable version but Since this openldap is deployed in Production it is not possible for us to upgrade it suddenly.
As you mentioned that ppolicy schema is missing in configuration, so is it possible that without having ppolicy schema, Openldap will remember the pwdHistory of the user ?
In my case pwdHistory is visible to users, for which I want to apply ACL so that a user can only see his/her pwdHistory , not other users pwdHistory.
Below are my configuration related to ppolicy configuration in config file:-
include /etc/openldap/schema/ppolicy.schema --- more include directive related to schema
---- moduleload ppolicy.la moduleload memberof.la overlay memberof overlay syncprov overlay auditlog #overlay accesslog overlay ppolicy ppolicy_default "cn=passwordDefault,dc=example,dc=com"
Thanks & Regards, Chandeshwar Kumar
On Mon, Feb 14, 2022 at 11:24 PM Quanah Gibson-Mount quanah@fast-mail.org wrote:
--On Saturday, February 12, 2022 5:22 AM +0000 kumarchandeshwar99@gmail.com wrote:
Hi, I am trying to restrict access to pwdHistory attributes provided by ppolicy overlay. I have applied the below ACL
access to attrs=pwdHistory by * none but while doing slaptest, its throwing below error:- /etc/openldap/slapd.conf: line 212: unknown attr "pwdHistory" in to
clause
<access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry |
children
<who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN>
]
[dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]Before posting here I searched archive and found one similar, issue , but it did not resolve my issue. I have running openldap-servers-2.4.23 on RHEL-6.5.
You are missing the ppolicy schema in your configuration.
However, I would note that both RHEL6 and OpenLDAP 2.4 are historic and no longer in support. I'd strongly advise upgrading to both an OS that is under support and a version of OpenLDAP that's under support.
Regards, Quanah