Re: Check ppolicy

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Tuesday 16 June 2009 18:37:25 Jordi Espasa Clofent wrote:
> In OpenLDAP server I can see that ppolicy is working as expected:
>
> Jun 16 18:12:13 xen-ldapbeta slapd[1834]: ppolicy_bind: Setting warning
> for password expiry for uid=jespasac,ou=CAT,ou=Tecnic,dc=company,dc=com
> = 112 seconds
> Jun 16 18:13:12 xen-ldapbeta slapd[1834]: ppolicy_bind: Setting warning
> for password expiry for uid=jespasac,ou=CAT,ou=Tecnic,dc=company,dc=com
> = 53 seconds
> Jun 16 18:13:44 xen-ldapbeta slapd[1834]: ppolicy_bind: Setting warning
> for password expiry for uid=jespasac,ou=CAT,ou=Tecnic,dc=company,dc=com
> = 21 seconds
> Jun 16 18:13:59 xen-ldapbeta slapd[1834]: ppolicy_bind: Setting warning
> for password expiry for uid=jespasac,ou=CAT,ou=Tecnic,dc=company,dc=com
> = 6 seconds
> Jun 16 18:14:11 xen-ldapbeta slapd[1834]: ppolicy_bind: Entry
> uid=jespasac,ou=CAT,ou=Tecnic,dc=company,dc=com has an expired password:
> 0 grace logins
> Jun 16 18:14:19 xen-ldapbeta slapd[1834]: ppolicy_bind: Entry
> uid=jespasac,ou=CAT,ou=Tecnic,dc=company,dc=com has an expired password:
> 0 grace logins
> Jun 16 18:19:43 xen-ldapbeta slapd[1834]: ppolicy_bind: Entry
> uid=jespasac,ou=CAT,ou=Tecnic,dc=company,dc=com has an expired password:
> 0 grace logins

Have you set 'pam_lookup_policy yes' in pam_ldap's ldap.conf?

Are you using pam_ldap in the "account" lines of your PAM configuration?

>
> but I don't understand why in the client prompt I don't see these
> warning. The only warning I see is when the password has already expired
> (setting up the 'pam_password_prohibit_message' in ldap.conf client side):
>
> You are required to change your LDAP password immediately.
> Please visit http://my_gui_to_change_password
> Old Password:
>
> ¿Why can I see this message and not the expire time or grace login
> warnings?