Re: password change and ppolicy

["Gustavo Mendes de Carvalho" <gmcarvalho@gmail.com>]

Hi Tizo,

Suposed that your users has to login in some linux/Unix machine using their
LDAP accounts, I sugest you to create some binary or script to allow your
users to change their passwords invoking ldappasswd command.

I mean, you can create a C program or shell script or even a PHP page, to
validate some weaks in their passwords, like min length, capital letters,
numbers, and so on.

After that, you can call ldappasswd command with all parameters (using
system() call in a C source code) to change it.
I know that this is not an elegant option, but it works.

Let me know if it works for you that I can post my C source code here to
help you there.

See you

Gustavo

Date: Wed, 10 Jun 2009 18:54:14 -0300
From: tizo <tizone@gmail.com>
Subject: Re: password change and ppolicy
To: openldap-technical@openldap.org
Message-ID:
	<e55f48520906101454i3e5b4b59v2b755278cd34437@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"

On Tue, Jun 9, 2009 at 12:12 PM, tizo <tizone@gmail.com> wrote:

>
> Before starting this, I have been testing password changing with
> phpLDAPAdmin. The fact is that I could only change a user password with
> clear text. I guess that this behaviour happens because we have
> pwdCheckQulity setting in 2 in our default password policy. So, when the
> client (phpLDAPAdmin) tries to modify the password enconding it, the
server
> (OpenLDAP) cannot check the min length of the password, as it is encoded,
> and then fails. I am guessing too, that phpLDAPAdmin is performing a
simple
> modify operation to change the password, as it is stored in clear text. On
> the other hand, I could change passwords with ldappasswd withouth problem,
> and they are stored with SSHA. I know that this command uses RFC 3062.
>
> tizo
>
>