Hello, I was new to openldap, I try to use the default ppolicy with openldap 2.4.21 on suse linux, I didn't find much info in detail about how to config it when using cn=config. Could you take a look what I am missing here.
I created and include the ldif file I think equivalent to slapd.conf , (convert the default ppolicy.shcema to ppolicy.ldif) : : include: file:///etc/openldap/schema/ppolicy.ldif : : dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com
Also I added the container and the policies : : dn: ou=policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: policies
dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: 2.5.4.35 #pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: TRUE sn: dummy value
the ppolicy.ldif look like this dn: cn=ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: ppolicy olcAttributeTypes: {0}( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY in tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY in tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQUAL ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUA LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQ UALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY b ooleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' E QUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUAL ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInter val' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQUAL ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQUAL ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'L oadable module that instantiates "check_password() function' EQUALITY caseExa ctIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP top AUXILIARY MAY pwdCheckModule ) olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AUXI LIARY MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheck Quality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) )
Somehow the policy didn't seems apply to my user entries, like the pwdMinLength or pwdExpireWarning not take effect at all. I tried with pwdCheckQuality 1 or 2 , both not working. I guess I am missing some config, the old way has a step to load the module, is there something similar I need to do the new way?
Really appreciate your time and help!
Sophie
For reference, this is a slightly older installation (2.4.17 on Ubuntu). I was recently informed that we had to implement the ppolicy overlay ASAP for compliance reasons in this environment. I don't have time to upgrade this particular cluster at the moment, so I'm trying to work with what I've got.
The following pastie shows my config (or rather, the LDIFs I used to create the config), and a partial trace of the slapcat that segfaults: http://pastie.org/1223869
Interestingly, someone else had an identical issue with 2.4.15 on Ubuntu: http://pastie.org/600973
Unfortunately, no solution was ever posted, and I haven't gotten to the bottom of it myself. I'm not quite sure what the problem is, but it seems to be specific to ppolicy, and as far as I can tell by reviewing the CVS log for commits to ppolicy.c, no changes have been made in any revisions since that would fix a segmentation fault (I'm using 1.75.2.27, and there have been only two unrelated ITS's since then as it pertains to ppolicy.c).
I'm open to suggestions as to what might be causing slapcat to segfault after the entries in my pastie above are added. I've tried using no default ppolicy, an empty default ppolicy, and with no custom pwdCheckModule, all to no avail.
TIA, Ryan
On Friday 15 October 2010 20:45:11 Ryan Steele wrote:
For reference, this is a slightly older installation (2.4.17 on Ubuntu). I was recently informed that we had to implement the ppolicy overlay ASAP for compliance reasons in this environment. I don't have time to upgrade this particular cluster at the moment, so I'm trying to work with what I've got.
The following pastie shows my config (or rather, the LDIFs I used to create the config), and a partial trace of the slapcat that segfaults: http://pastie.org/1223869
Interestingly, someone else had an identical issue with 2.4.15 on Ubuntu: http://pastie.org/600973
Unfortunately, no solution was ever posted, and I haven't gotten to the bottom of it myself. I'm not quite sure what the problem is, but it seems to be specific to ppolicy, and as far as I can tell by reviewing the CVS log for commits to ppolicy.c, no changes have been made in any revisions since that would fix a segmentation fault (I'm using 1.75.2.27, and there have been only two unrelated ITS's since then as it pertains to ppolicy.c).
I'm open to suggestions as to what might be causing slapcat to segfault after the entries in my pastie above are added. I've tried using no default ppolicy, an empty default ppolicy, and with no custom pwdCheckModule, all to no avail.
Please try reproducing you problem with the latest release (2.4.23) or CVS HEAD. If it still fails with that, open a bug report through the ITS (http://www.openldap.org/its) containing the relevant information (configs, stack backtrace of the segfault, steps to reproduce, ...).
openldap-technical@openldap.org
-
Ralf Haferkamp -
Ryan Steele -
sophie ailin