Thanks for your response. Our setup is a very old one and we are planning
to migrate it to the latest stable version but Since this openldap is
deployed in Production
it is not possible for us to upgrade it suddenly.
As you mentioned that ppolicy schema is missing in configuration, so is it
possible that without having ppolicy schema, Openldap will remember the
pwdHistory of the user ?
In my case pwdHistory is visible to users, for which I want to apply ACL so
that a user can only see his/her pwdHistory , not other users pwdHistory.
Below are my configuration related to ppolicy configuration in config file:-
--- more include directive related to schema
Thanks & Regards,
On Mon, Feb 14, 2022 at 11:24 PM Quanah Gibson-Mount <quanah(a)fast-mail.org>
--On Saturday, February 12, 2022 5:22 AM +0000
> I am trying to restrict access to pwdHistory attributes provided by
> ppolicy overlay. I have applied the below ACL
> access to attrs=pwdHistory
> by * none
> but while doing slaptest, its throwing below error:-
> /etc/openldap/slapd.conf: line 212: unknown attr "pwdHistory" in to
> <access clause> ::= access to <what> [ by <who> [ <access> ]
> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>]
> [attrs=<attrspec>] <attrspec> ::= <attrname>
> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist>
> <attr> [ , <attrlist> ]
> <attr> ::= <attrname> | @<objectClass> | !<objectClass> |
> <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ]
> [ realanonymous | realusers | realself |
> [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>]
> Before posting here I searched archive and found one similar, issue , but
> it did not resolve my issue. I have running openldap-servers-2.4.23 on
You are missing the ppolicy schema in your configuration.
However, I would note that both RHEL6 and OpenLDAP 2.4 are historic and no
longer in support. I'd strongly advise upgrading to both an OS that is
under support and a version of OpenLDAP that's under support.