On Tue, Oct 20, 2026 at 01:09:31PM +0000, BECOT Jérôme wrote:

Hello,

I have a consumer (2.5) using ppolicy and the chain overlay to forward updates to the provider node. We use olcSecurity: ssf=128 simple_bind=128 update_ssf=256 on the consumer side, but allow 128bit ciphers.

We expected that clients using less secured ciphers would not be able to do any write operation on the consumer (forwarded by the chain overlay /olcPpolicyForward updates is True on the database config), but it also affects the password policy that is not able to update security fields like pwdFailureTime (we get a 'ppolicy_bind_response: ppolicy state change failed with rc=13 text=stronger confidentiality required for update' error in the logs).

I'm surprised that the SSF check applies to ppolicy as it is an overlay that only applies operational attribute updates in this case.

Is it the intended behaviour or did we have miss something ?

Hello Jérôme, there appears to be no escape hatch for backend restrictions like these at the moment. I suggest you file an ITS so it can be tracked.

I would also suggest you upgrade to 2.6 soon as 2.5 is nearing its end of support on January 15, 2027:

https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/th...

Thanks,