Re: ppolicy overlay trick

[Howard Chu <hyc@symas.com>]

Dmitriy Kirhlarov wrote:
> Hi, list.
>
> The are several ways to implement password policy now -- shadowAccount
> for pam, sambaAccountPolicy for samba and password policy overlay for
> both.
> All this are not perfect.
> shadowAccount and sambaAccountPolicy can't block login to www, for
> example, and they work on client side.
> ppolicy overlay work fine, but, if password blocked, client, usualy,
> haven't details.
>
> My idea -- mapping ppolicy overlay rules to samba and shadow fields in
> users dn on server side. Is it possible? If yes -- how?

You could probably write an overlay to intercept ppolicy updates and 
translate them into other attributes, but that would mostly be a waste 
of effort. PADL's pam_ldap already supports the ppolicy control, so if 
you use it you'll get all of the policy messages. (Except, see ITS#4528, 
which will be fixed in the 2.3.22 release.) So there's no reason to mess 
with the shadow attributes at all.

I recall that Andrew Bartlett was looking into making Samba cooperate 
with LDAP ppolicy too; I would chase that route instead of trying to map 
back and forth.

--
 -- Howard Chu
 Chief Architect, Symas Corp.  http://www.symas.com
 Director, Highland Sun        http://highlandsun.com/hyc
 OpenLDAP Core Team            http://www.openldap.org/project/