Running OpenLdap 2.4.23 on Centos 6.4

n: cn=policy,ou=policies,dc=XXXX,dc=test

Yes, that should be a "dn:" at the top of the ldif file, not an "n:". I'll review the list for issues with OpenLdap 2.4.23 on Centos 6.4. Any thoughts on my specific issue? Its killing me, been chasing it for days. Feels like the policy/schema isn't loading at all.

Running OpenLdap 2.4.23 on Centos 6.4 and we are having truoble enabling password polices. I've read a number of FAQ's online, plus spent hours searching for a solution to this problem, although a lot of folks seem to have the same issue I haven't been able to find a solution that works for us. I run into trouble running ldapadd to import the new policy. I end up with the invalid syntax error I've included below, along with a copy of the .ldif file and my slapd.conf file. I was able to create the policies OU without issue, I also tried using the OID for pwdAttribute instead of userPassword. [root@asu10d schema]# ldapadd -D "cn=Manager,dc=XXXX,dc=test" -W -x -f /tmp/ppolicy.ldif Enter LDAP Password: adding new entry "cn=policy,ou=policies,dc=XXXX,dc=test" ldap_add: Invalid syntax (21) additional info: pwdAttribute: value #0 invalid per syntax

Contents of policy.ldif n: cn=policy,ou=policies,dc=XXXX,dc=test cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value Contents of my slapd.conf include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/pmi.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap moduleload ppolicy.la TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=XXXX,dc=test" read by * none database bdb suffix "dc=XXXXX,dc=test" checkpoint 1024 15 rootdn "cn=Manager,dc=XXXX,dc=test" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw hello (Temp password used for testing) overlay ppolicy policy_default "cn=default,ou=policies,dc=XXXX,dc=test" policy_use_lockout directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub

Thanks. I've checked and rechecked the /tmp/ppolicy.ldif for stray/illegal characters, spaces, etc. I can't find anything. I deleted and recreated the file, the line, everything I could think of.

Agree with you on upgrading, that¹s in the plan as well.

On 9/16/13 5:09 PM, "Christian Kratzer" <ck-lists(a)cksoft.de&gt; wrote: > Hi, > > On Mon, 16 Sep 2013, Philip Bubel wrote: > >> Running OpenLdap 2.4.23 on Centos 6.4 and we are having truoble >> enabling password polices. I've read a number of FAQ's online, plus >> spent hours searching for a solution to this problem, although a lot of >> folks seem to have the same issue I haven't been able to find a solution >> that works for us. I run into trouble running ldapadd to import the new >> policy. I end up with the invalid syntax error I've included below, >> along with a copy of the .ldif file and my slapd.conf file. I was able >> to create the policies OU without issue, I also tried using the OID for >> pwdAttribute instead of userPassword. >> >> [root@asu10d schema]# ldapadd -D "cn=Manager,dc=XXXX,dc=test" -W -x -f >> /tmp/ppolicy.ldif >> Enter LDAP Password: >> adding new entry "cn=policy,ou=policies,dc=XXXX,dc=test" >> ldap_add: Invalid syntax (21) >> additional info: pwdAttribute: value #0 invalid per syntax > > Please check you /tmp/ppolicy.ldif that there are now illegal characters > in the line with pwdAttribute: > > It looks like this is perhaps borken. > > Please also consider updating to the latest openldap 2.4.36 via one of > the openly available rpm. > > Greetings > Christian > >> >> Contents of policy.ldif >> n: cn=policy,ou=policies,dc=XXXX,dc=test >> cn: default >> objectClass: pwdPolicy >> objectClass: person >> objectClass: top >> pwdAllowUserChange: TRUE >> pwdAttribute: userPassword >> pwdCheckQuality: 2 >> pwdExpireWarning: 600 >> pwdFailureCountInterval: 30 >> pwdGraceAuthNLimit: 5 >> pwdInHistory: 5 >> pwdLockout: TRUE >> pwdLockoutDuration: 0 >> pwdMaxAge: 0 >> pwdMaxFailure: 5 >> pwdMinAge: 0 >> pwdMinLength: 5 >> pwdMustChange: FALSE >> pwdSafeModify: FALSE >> sn: dummy value >> >> Contents of my slapd.conf >> >> include /etc/openldap/schema/corba.schema >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/duaconf.schema >> include /etc/openldap/schema/dyngroup.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/java.schema >> include /etc/openldap/schema/misc.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/openldap.schema >> include /etc/openldap/schema/ppolicy.schema >> include /etc/openldap/schema/collective.schema >> include /etc/openldap/schema/samba.schema >> include /etc/openldap/schema/pmi.schema >> >> allow bind_v2 >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> modulepath /usr/lib64/openldap >> >> moduleload ppolicy.la >> >> TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt >> TLSCertificateFile /etc/pki/tls/certs/slapd.pem >> TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem >> >> database config >> access to * >> by >> dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read >> by dn.exact="cn=Manager,dc=XXXX,dc=test" read >> by * none >> >> database bdb >> suffix "dc=XXXXX,dc=test" >> checkpoint 1024 15 >> rootdn "cn=Manager,dc=XXXX,dc=test" >> # Cleartext passwords, especially for the rootdn, should >> # be avoided. See slappasswd(8) and slapd.conf(5) for details. >> # Use of strong authentication encouraged. >> rootpw hello (Temp password used for testing) >> >> overlay ppolicy >> policy_default "cn=default,ou=policies,dc=XXXX,dc=test" >> policy_use_lockout >> >> directory /var/lib/ldap >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> >> > > -- > Christian Kratzer CK Software GmbH > Email: ck(a)cksoft.de Wildberger Weg 24/2 > Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden > Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart > Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian > Kratzer

On Mon, 16 Sep 2013 20:44:24 +0000 Philip Bubel <philip(a)bubel.com&gt; wrote > ldap_add: Invalid syntax (21) > additional info: pwdAttribute: value #0 invalid per syntax > [..] > pwdAttribute: userPassword Should be this: pwdAttribute: 2.5.4.35

Just tired it use " pwdAttribute: 2.5.4.35". I must have tired it with a different OID. Thanks everybody, will test more in the morning. -----Original Message----- From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] Sent: Monday, September 16, 2013 7:23 PM To: Michael Ströder; openldap-technical(a)openldap.org; Philip Bubel Subject: Re: invalid syntax (21) error while importing password password policy --On Tuesday, September 17, 2013 12:33 AM +0200 Michael Ströder <michael(a)stroeder.com&gt; wrote: > On Mon, 16 Sep 2013 20:44:24 +0000 Philip Bubel <philip(a)bubel.com&gt; > wrote >> ldap_add: Invalid syntax (21) >> additional info: pwdAttribute: value #0 invalid per syntax [..] >> pwdAttribute: userPassword > > Should be this: > > pwdAttribute: 2.5.4.35 Support for using "userPassword" as well as the OID was added back in OpenLDAP 2.3. It *should* work with either one. As my test run with test022 did. --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra Software, LLC -------------------- Zimbra :: the leader in open source messaging and collaboration

--On Tuesday, September 17, 2013 4:08 AM +0000 Philip Bubel <philip(a)bubel.com&gt; wrote: > I was able to add the new policy but I'm having trouble applying it to >an > existing user. Here's the .ldif file I"m using and the error I"m >getting. > ># ldapmodify -D "cn=Manager,dc=XXX,dc=test" -W -x -f /tmp/apply.ldif > Enter LDAP Password: > modifying entry "cn=bwayne,ou=users,dc=XXX,dc=test" > ldap_modify: Undefined attribute type (17) > additional info: pwdPolicySubentry: attribute type undefined This indicates that the ppolicy overlay is not loaded. So did the fact that you couldn't use "userPassword" earlier, which I noted then. Switching to the OID simply let you bypass the fact that the ppolicy overlay wasn't loaded. So now you have two errors that indicate that slapd has not loaded the ppolicy overlay. I would advise you, again, to figure out why ppolicy isn't loading. First by answering the question I asked you earlier -- Does the ppolicy.la file even exist in the modulepath you specified? --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra Software, LLC -------------------- Zimbra :: the leader in open source messaging and collaboration

Just confirmed that policy.la is in the correct place. Here's what I have in slapd.conf modulepath /usr/lib64/openldap moduleload ppolicy.la [csadmin@XXX openldap]$ ls -la | grep pp lrwxrwxrwx 1 root root 20 Aug 22 16:06 ppolicy-2.4.so.2 -> ppolicy-2.4.so.2.5.6 -rwxr-xr-x 1 root root 39824 Apr 29 03:50 ppolicy-2.4.so.2.5.6 -rwxr-xr-x 1 root root 936 Apr 29 03:49 ppolicy.la Anything else I can check?

I run slapd -d -1 and looked through the output and it appears the policy is loading. See below. Any other thoughts? We are looking at new server versions as well ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={10}ppolicy.ldif" =>

To avoid having to post the entire output any keywords I can look for in the output?

On Mon, 16 Sep 2013 20:44:24 +0000 Philip Bubel <philip(a)bubel.com&gt; wrote > ldap_add: Invalid syntax (21) > additional info: pwdAttribute: value #0 invalid per syntax > [..] > pwdAttribute: userPassword Should be this: pwdAttribute: 2.5.4.35