[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: ldap bind and password policy

To: Christian Bösch <boesch@fhv.at>
Subject: Re: ldap bind and password policy
From: Marco Pizzoli <marco.pizzoli@gmail.com>
Date: Fri, 2 Jul 2010 16:18:51 +0200
Cc: openldap-technical@openldap.org
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:in-reply-to :references:from:date:message-id:subject:to:cc:content-type; bh=T5BlGMPlgQk5iCbbyruClKmztxPRTesEI5s4by70uxM=; b=vO6cAur/3KShyIEThK17dK84QPl7efkDdr7sPfzaQDxYMwhIhjnMqxxxsHTR2pL/gH 2qBOifGjSCSNvklXJh/lerPP2vZhZC+PmT+kepnZNYbbHiRxiUDC49lvMxE+ab34cJfe QjmNNhw8ihEJ6/d7+ne+dl6Mv2oDxeEOkTjBI=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=PKXZORDCyHVV0a2a/o4MZ08DA1Hzy9mAO6dLLF12snpNzH0hCQRPwtfe2YCu8DELEl W/Pu4iVy18Hsv0sgNZ/r/EfxgIx/xOcGQYzrgySwCDBKQFQosavUR5m5qXI6jj8wx1/z zVJybbFtq5zi3S9xVMNLDraP+72IyuqNYbK7s=
In-reply-to: <44181BBA-CE2D-46DC-A286-FD7EBC007AD1@fhv.at>
References: <44181BBA-CE2D-46DC-A286-FD7EBC007AD1@fhv.at>

Hi, you have to add in your configuration of ppolicy overlay the directive about the forwarding of operational attirbutes related to ppolicy to the master server. So you have this attributes syncronized in all your servers.

ppolicy_forward_updates available since version 2.4.18.

Regards
Marco

On Fri, Jul 2, 2010 at 1:46 PM, Christian Bösch <boesch@fhv.at> wrote:

hi,

i just added password policy overlay to our openldap servers (2.4.21)
it works fine in general. i can change password as user and it gets well replicated
between provider and consumer.

but since i added password policy i have a strange behaviour:
_i do a ldapsearch on the provider and type in a wrong password for the binding user,
then i get: ldap_bind: Invalid credentials (49) - as expected
_if i do the same on the consumer (type in wrong password for binding) ldapsearch
get me search results without to complain about wrong password. it just adds a pwdFailureTime
attribute on the provider and consumer. but i also expect to get a ldap_bind: Invalid credentials (49) error?

thx for any ideas!

/chris

--
_________________________________________
Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi.
Jim Morrison

Follow-Ups:
- Re: ldap bind and password policy
  - From: Chris Jacobs <Chris.Jacobs@apollogrp.edu>

References:
- ldap bind and password policy
  - From: Christian Bösch <boesch@fhv.at>

Prev by Date: ldap bind and password policy
Next by Date: Re: ldap bind and password policy
Index(es):
- Chronological
- Thread