1:42 p.m.
it appears from looking at ppolicy.c that pwdAccountLockedTime is not
supported in openlda. is there another way to lock a users account in
openldap outside of simply changing the users password?
---
Regards,
Kevin Martin
3:04 a.m.
New subject: Antw: [EXT] openldap ppolicy pwdAccountLockedTime
>> kevin martin <ktmdms(a)gmail.com> schrieb am 22.12.2021
um 22:42 in Nachricht
<CACyJYa2V+d1Cv6TgK7PzWS36ij-aih6STL2jE2HZv0R-DwoRow(a)mail.gmail.com>:
it appears from looking at ppolicy.c that pwdAccountLockedTime is
not
supported in openlda. is there another way to lock a users account in
openldap outside of simply changing the users password?
I found out the hard way: When all grace logins were consumed after the user should have
changed the password, the user can no longer log in (and he/she cannot change the password
either).
---
Regards,
Kevin Martin
9:23 a.m.
On 12/27/21 12:04, Ulrich Windl wrote:
>>> kevin martin <ktmdms(a)gmail.com> schrieb am
22.12.2021 um 22:42 in Nachricht
<CACyJYa2V+d1Cv6TgK7PzWS36ij-aih6STL2jE2HZv0R-DwoRow(a)mail.gmail.com>:
> it appears from looking at ppolicy.c that pwdAccountLockedTime is not
> supported in openlda. is there another way to lock a users account in
> openldap outside of simply changing the users password?
I found out the hard way: When all grace logins were consumed after
the user should have changed the password, the user can no longer log
in (and he/she cannot change the password either).
But that's not what the
original poster asked for.
See slapo-policy(5) [1]:
"If pwdAccountLockedTime is set to 000001010000Z, the user's account has
been permanently locked and may only be unlocked by an administrator."
IIRC this works. If not, then it's a bug.
In Æ-DIR I let admins maintain a status attribute 'aeStatus' which is
also evaluated by ACLs on userPassword to deactivate authentication
(auth privilege granted to anonymous only for active entries).
Ciao, Michael.
[1] https://www.openldap.org/software/man.cgi?query=slapo-ppolicy
3 p.m.
Pwdaccountlockedtime isn't an attribute that can be set in the database
since ppolicy is now compiled into openldap as opposed to it being a schema
that's pulled in and that attribute is not defined in the source code. I
would say that, based on the man page, it's a bug.
On Fri, Dec 31, 2021, 11:23 AM Michael Ströder <michael(a)stroeder.com> wrote:
On 12/27/21 12:04, Ulrich Windl wrote:
>>>> kevin martin <ktmdms(a)gmail.com> schrieb am 22.12.2021 um 22:42 in
Nachricht
> <CACyJYa2V+d1Cv6TgK7PzWS36ij-aih6STL2jE2HZv0R-DwoRow(a)mail.gmail.com>:
>> it appears from looking at ppolicy.c that pwdAccountLockedTime is not
>> supported in openlda. is there another way to lock a users account in
>> openldap outside of simply changing the users password?
>
> I found out the hard way: When all grace logins were consumed after
> the user should have changed the password, the user can no longer log
> in (and he/she cannot change the password either).
But that's not what the original poster asked for.
See slapo-policy(5) [1]:
"If pwdAccountLockedTime is set to 000001010000Z, the user's account has
been permanently locked and may only be unlocked by an administrator."
IIRC this works. If not, then it's a bug.
In Æ-DIR I let admins maintain a status attribute 'aeStatus' which is
also evaluated by ACLs on userPassword to deactivate authentication
(auth privilege granted to anonymous only for active entries).
Ciao, Michael.
[1] https://www.openldap.org/software/man.cgi?query=slapo-ppolicy
1:51 a.m.
On 1/1/22 00:00, kevin martin wrote:
Pwdaccountlockedtime isn't an attribute that can be set in the
database
since ppolicy is now compiled into openldap as opposed to it being a
schema that's pulled in and that attribute is not defined in the source
code. I would say that, based on the man page, it's a bug.
No bug here. It works as expected.
I've tested this with 2.6.0.
Indeed the schema is now hard-coded in servers/slapd/overlays/ppolicy.c
but 'pwdAccountLockedTime' can be used in exactly the same way like before.
Ciao, Michael.
1:21 a.m.
New subject: Antw: [EXT] Re: openldap ppolicy pwdAccountLockedTime
>> kevin martin <ktmdms(a)gmail.com> schrieb am 01.01.2022
um 00:00 in
Nachricht
<CACyJYa0rYAhJwbbc6Mp4NMV2g7Kj3W2Y1vqmu0jAbihdnc5zNg(a)mail.gmail.com>:
Pwdaccountlockedtime isn't an attribute that can be set in the
database
since ppolicy is now compiled into openldap as opposed to it being a schema
that's pulled in and that attribute is not defined in the source code. I
would say that, based on the man page, it's a bug.
In 2.4 I can query it from cn=schema,cn=config:
( 1.3.6.1.4.1.42.2.27.8.1.17 NAME 'pwdAccountLockedTime' DESC 'The time an
user account was locked' EQUALITY generalizedTimeMatch ORDERING
generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE
USAGE directoryOperation )
On Fri, Dec 31, 2021, 11:23 AM Michael Ströder <michael(a)stroeder.com>
wrote:
> On 12/27/21 12:04, Ulrich Windl wrote:
> >>>> kevin martin <ktmdms(a)gmail.com> schrieb am 22.12.2021 um 22:42
in
> Nachricht
> > <CACyJYa2V+d1Cv6TgK7PzWS36ij-aih6STL2jE2HZv0R-DwoRow(a)mail.gmail.com>:
> >> it appears from looking at ppolicy.c that pwdAccountLockedTime is not
> >> supported in openlda. is there another way to lock a users account in
> >> openldap outside of simply changing the users password?
> >
> > I found out the hard way: When all grace logins were consumed after
> > the user should have changed the password, the user can no longer log
> > in (and he/she cannot change the password either).
> But that's not what the original poster asked for.
>
> See slapo-policy(5) [1]:
>
> "If pwdAccountLockedTime is set to 000001010000Z, the user's account has
> been permanently locked and may only be unlocked by an administrator."
>
> IIRC this works. If not, then it's a bug.
>
> In Æ-DIR I let admins maintain a status attribute 'aeStatus' which is
> also evaluated by ACLs on userPassword to deactivate authentication
> (auth privilege granted to anonymous only for active entries).
>
> Ciao, Michael.
>
> [1] https://www.openldap.org/software/man.cgi?query=slapo-ppolicy
>
7:39 a.m.
New subject: [EXT] Re: openldap ppolicy pwdAccountLockedTime
In 2.4 I was still pulling in the schema. In 2.5 ppolicy is compiled as
part of the code. Assuming it just works, how does one go about setting
pwdAccountLockedTime for a user then? I can't add it as an attribute of
the user so I'm not sure how it can be set.
On Mon, Jan 3, 2022, 3:21 AM Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de>
wrote:
>>> kevin martin <ktmdms(a)gmail.com> schrieb am
01.01.2022 um 00:00 in
Nachricht
<CACyJYa0rYAhJwbbc6Mp4NMV2g7Kj3W2Y1vqmu0jAbihdnc5zNg(a)mail.gmail.com>:
> Pwdaccountlockedtime isn't an attribute that can be set in the database
> since ppolicy is now compiled into openldap as opposed to it being a
schema
> that's pulled in and that attribute is not defined in the source code. I
> would say that, based on the man page, it's a bug.
In 2.4 I can query it from cn=schema,cn=config:
( 1.3.6.1.4.1.42.2.27.8.1.17 NAME 'pwdAccountLockedTime' DESC 'The time an
user account was locked' EQUALITY generalizedTimeMatch ORDERING
generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
SINGLE-VALUE
USAGE directoryOperation )
>
> On Fri, Dec 31, 2021, 11:23 AM Michael Ströder <michael(a)stroeder.com>
wrote:
>
>> On 12/27/21 12:04, Ulrich Windl wrote:
>> >>>> kevin martin <ktmdms(a)gmail.com> schrieb am 22.12.2021 um
22:42 in
>> Nachricht
>> >
<CACyJYa2V+d1Cv6TgK7PzWS36ij-aih6STL2jE2HZv0R-DwoRow(a)mail.gmail.com>:
>> >> it appears from looking at ppolicy.c that pwdAccountLockedTime is not
>> >> supported in openlda. is there another way to lock a users account
in
>> >> openldap outside of simply changing the users password?
>> >
>> > I found out the hard way: When all grace logins were consumed after
>> > the user should have changed the password, the user can no longer log
>> > in (and he/she cannot change the password either).
>> But that's not what the original poster asked for.
>>
>> See slapo-policy(5) [1]:
>>
>> "If pwdAccountLockedTime is set to 000001010000Z, the user's account
has
>> been permanently locked and may only be unlocked by an administrator."
>>
>> IIRC this works. If not, then it's a bug.
>>
>> In Æ-DIR I let admins maintain a status attribute 'aeStatus' which is
>> also evaluated by ACLs on userPassword to deactivate authentication
>> (auth privilege granted to anonymous only for active entries).
>>
>> Ciao, Michael.
>>
>> [1] https://www.openldap.org/software/man.cgi?query=slapo-ppolicy
>>
8:41 a.m.
New subject: [EXT] Re: openldap ppolicy pwdAccountLockedTime
--On Monday, January 3, 2022 9:39 AM -0600 kevin martin <ktmdms(a)gmail.com>
wrote:
In 2.4 I was still pulling in the schema. In 2.5 ppolicy is compiled as
part of the code. Assuming it just works, how does one go about setting
pwdAccountLockedTime for a user then? I can't add it as an attribute of
the user so I'm not sure how it can be set.
If it has been moduleloaded into the slapd process, the ppolicy schema is
known to slapd and available for use. If you are finding the attribute to
not be defined it would suggest you've failed to load the module as
required. I would note that you want to ensure you're running 2.5.8 or
later (See ITS#9671).
--Quanah
--
Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>
8:59 a.m.
New subject: [EXT] Re: openldap ppolicy pwdAccountLockedTime
On 1/3/22 16:39, kevin martin wrote:
Assuming it just works, how does one go about setting
pwdAccountLockedTime for a user then? I can't add it as an attribute of
the user so I'm not sure how it can be set.
If 'pwdAccountLockedTime' is not present in your subschema subentry then
slapo-ppolicy module is not correctly loaded.
Ciao, Michael.
9:03 a.m.
New subject: Antw: [EXT] openldap ppolicy pwdAccountLockedTime
On 12/27/21 3:04 AM, Ulrich Windl wrote:
I found out the hard way: When all grace logins were consumed after
the user should have changed the password, the user can no longer log in (and he/she
cannot change the password either).
Future people reading this list may benefit from knowing that this is
spelled out in the "Password Policy for LDAP Directories" reference in
the man page:
https://tools.ietf.org/id/draft-behera-ldap-password-policy-10.html. See
section 4.2.1.
You are welcome, future people.
Chris Paul | Rex Consulting | https://www.rexconsulting.net
449
days inactive
461
days old
openldap-technical@openldap.org
9 comments
5 participants
participants (5)
-
Christopher Paul -
kevin martin -
Michael Ströder -
Quanah Gibson-Mount -
Ulrich Windl