RE: password-policy configuration problems: cannot change passwords

[Marco Weber <marco.weber@mpulse.eu>]

Ok, I've changed the password:
ldapmodify -D cn=username,dc=domain,dc=tld -W
dn: cn=username,dc=domain,dc=tld
changetype: modify
replace: userPassword
userPassword: TheNewValue

then i tried to change the password using ldappasswd:
ldappasswd -D cn=username,dc=domain,dc=tld -S -W
New password:
Re-enter new password:
Enter LDAP Password:
Result: Constraint violation (19)
Additional info: Password policy only allows one password value

It seems like it didn't help.
I think it must be something else.


this is my default password policy:
dn: cn=password-policy,dc=policies,dc=domain,dc=tld
objectClass: person
objectClass: pwdPolicy
objectClass: top
cn: password-policy
pwdAttribute: userPassword
sn: Default Password Policy
pwdAllowUserChange: TRUE
pwdExpireWarning: 604800
pwdInHistory: 3
pwdLockout: TRUE
pwdLockoutDuration: 7200
pwdMaxAge: 7776000
pwdMaxFailure: 5
pwdMinAge: 180
pwdMinLength: 8
pwdMustChange: TRUE

this is my password policy configuration:
dn: olcOverlay=ppolicy,dc=policies,dc=domain,dc=tld
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
objectClass: top
olcOverlay: ppolicy
olcPPolicyDefault: cn=password-policy,dc=policies,dc=domain,dc=tld
olcPPolicyUseLockout: TRUE

And I'm using openldap on RHEL:
Name        : openldap-servers
Arch        : x86_64
Version     : 2.4.23
Release     : 15.el6_1.3
>From repo   : rhel-x86_64-server-6


-----Original Message-----
From: Michael Ströder [mailto:michael@stroeder.com] 
Sent: Mittwoch, 26. Oktober 2011 20:35
To: Marco Weber
Cc: openldap-technical@openldap.org
Subject: Re: password-policy configuration problems: cannot change passwords

Marco Weber wrote:
> Indeed, I've changed the olcPasswordHash setting.
> And what kind of software "sends an appropriate ModifyRequest with MOD_REPLACE" ?
> 
> Ldapmodify -D cn=username,dc=domain,dc=tld -W
> dn: cn=username,dc=domain,dc=tld
> changetype: modify
> replace: userPassword
> userPassword: TheNewValue
> 
> Is this a MOD_REPLACE request?

Yes, this is correct. You can use slappasswd to generate pre-hashed passwords and put it in the LDIF as TheNewValue.

Ciao, Michael.