[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: shadowLastChange not updating

To: "Allgood, John" <jallgood@ohl.com>
Subject: Re: shadowLastChange not updating
From: Matthew Backes <mbackes@symas.com>
Date: Fri, 21 May 2010 15:50:07 -0500
Cc: "'openldap-technical@openldap.org'" <openldap-technical@openldap.org>
In-reply-to: <DF1F44E4E77287409E73C3210D93934811CBC31751@NOC-ML-100.ohlogistics.com>
References: <DF1F44E4E77287409E73C3210D93934811CBC3172C@NOC-ML-100.ohlogistics.com> <DF1F44E4E77287409E73C3210D93934811CBC31751@NOC-ML-100.ohlogistics.com>

Hello, John.

> I am still not getting shadowLastChange to update. I am using the ldappasswd command to set the password and it does change the password but the shadowLastChange is not being updated. Anyone got any feedback for me. I am beginning to wonder if there is a bug in this older version of openldap that Centos is using.

As mentioned in the manpage, ldappasswd uses the LDAPv3 Password Modify (RFC 3062) extended operation.  This operation allows the server to automatically hash the supplied password.

If the password policy overlay is loaded and attached, it may update the pwdChangedTime attribute.

Under no circumstances should this have anything to do with shadowLastChange, which is part of the unrelated RFC 2307 schema.

Modern LDAP PAM-modules should be able to use the ppolicy mechanisms to enforce changes instead.  Try checking out slapo-ppolicy?

Matthew Backes
Symas Corporation
mbackes@symas.com

Follow-Ups:
- RE: shadowLastChange not updating
  - From: "Allgood, John" <jallgood@ohl.com>

References:
- shadowLastChange not updating
  - From: "Allgood, John" <jallgood@ohl.com>
- RE: shadowLastChange not updating
  - From: "Allgood, John" <jallgood@ohl.com>

Prev by Date: RE: shadowLastChange not updating
Next by Date: RE: shadowLastChange not updating
Index(es):
- Chronological
- Thread