Since both the password-hash and password-crypt-salt-format are Global options, is it possible to specify the password-hash on a per BDB backend basis?
For example, I have 4 BDB backends and I'd like them all to have the CRYPT and salt listed below sans one BDB backend where it needs to be CLEARTEXT.
However, when I specify this configuration in sladp.conf and bounce slapd I get the following error when trying to change a users password with the ldappasswd command. It's worth nothing that an ldapmodify to the userPassword attribute works just fine. I use security ssf=256, which is a Global option as well on a per BDB backend basis and this works just fine so I assumed this config for hashes would work as well.
Error message:
"Result: Constraint violation (19) Additional info: Password policy only allows one password value"
Relevant config below:
## GLOBAL SETTING password-hash {CRYPT} password-crypt-salt-format $6$%.12s
### BDB DATABASE SETTING database bdb suffix "dc=testldap,dc=com" rootdn "cn=LDAPAdmin,dc=testldap,dc=com" directory /var/lib/ldap/testldap password-hash {CLEARTEXT}
Michael wrote:
Since both the password-hash and password-crypt-salt-format are Global options, is it possible to specify the password-hash on a per BDB backend basis?
No. That's what "global option" means.
Date: Thu, 14 Aug 2014 08:16:29 -0700 From: hyc@symas.com To: mlstarling31@hotmail.com; openldap-technical@openldap.org Subject: Re: Specifying multiple password hashes
Michael wrote:
Since both the password-hash and password-crypt-salt-format are Global options, is it possible to specify the password-hash on a per BDB backend basis?
No. That's what "global option" means.
-- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
The manpage for slapd.conf has the following:
GLOBAL CONFIGURATION OPTIONS Options described in this section apply to all backends, unless specifically overridden in a backend definition. Arguments that should be replaced by actual text are shown in brackets <>.
How is that statement valid if that's the case? Also, I'm able to use security ssf on a per BDB basis without an issue. How do we know which Global options can be overridden?
openldap-technical@openldap.org