Re: smbk5pwd and ppolicy working together

[Ryan Steele <rsteele@archer-group.com>]

Adam, Howard, and list,

Upon Howard's suggestion, I went and re-read the docs on ACL's for
slapd.conf.   What I came up with is the following (I'll change the
first asterisk to the specific attributes once I've actually got it
working...):

# ACL's
access to *
   by dn.exact="cn=pwdchanger,dc=example,dc=com" write
   by * break

access to
attrs=userPassword,sambaNTPassword,sambaLMPassword,shadowLastChange,shadowMax,sambaPwdLastSet,sambaPwdMustChange
   by   self    write
   by   *       auth

access to *
   by   *       read

I also set the 'ldap admin dn' to be cn=pwdchanger,dc=example,dc=com in
my smb.conf, and added him to the smbpasswd database.

I'm happy to report that my initial testing shows that ppolicy indeed is
being adhered to now.  A big thank you to Howard, Adam, Pat, and others
who assisted me.  I have noticed, as Thierry Lacoste pointed out, that
Windows reports a successful password change when the password fails
ppolicy restrictions - but ONLY if I have logging set to 0.  I have no
idea why the two are related.  If I have logging turned on (even to 1),
Windows reports "The system cannot change your password now because the
domain DOMAINNAME is unavailable", but at least it's confirmation on the
user end that the change didn't take.  However, this is a Samba issue,
not an LDAP issue, so I'll take my findings to their mailing list.

Again, thanks to those who helped me.

Best Regards,
Ryan