(ITS#7228) Authentication Problem When Using PPolicy and Chaining

[jong.limb@dss.virginia.gov]

Full_Name: Jong K. Limb
Version: 2.4.23
OS: RHEL 5.3
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (166.67.66.5)


I have the following setup:
- Provider LDAP server used only by those applications that change passwords
- Consumer LDAP servers used by all applications that want to authenticate
users
- The provider and consumers have password policy configured so that the
accounts lock after 3 failed attempts
- In order to maintain synchronization of failed login attempts across all
consumers, I also enabled chaining from the consumers to the master

If an attempt is made to authenticate against the consumer with an invalid
password (for example, using ldapsearch), the pwdFailureTime attribute is
added/updated on the provider and eventually synced to the consumer, but the
operation succeeds when it should not have.

If I remove the password policy overlay (leaving all other configuration the
same) and run ldapsearch with an invalid password against a consumer, the
operation will fail with invalid credentials as it should.

I have done a little debugging, and it looks like the response that gets
returned to the client is the response to the modify operation that the consumer
makes to the provider to add/update the pwdFailureTime attribute, and not the
response to the bind operation.  The modify operation is successful here, so the
client continues on with the search or other operation.