Re: Configuring ppolicy problem

[cbulist <cbulist@gmail.com>]

Guillaume,

I did a test with your suggestion and now It is working when I change 
the pwdMaxAge to some short time as 15 seconds but I don't receive any 
message invite me to change the password or any warning message for 
expiration time.
I see the follow message in debug mode:

uid=user1,ou=People,dc=sample,dc=com  has an expired password

I set the attributes in default Policies:

pwsGraceAuthNLimit: 2
pwdAllowUserChange: TRUE
pwdExpireWarning: 10
pwdLockout: TRUE
pwdMaxAge: 15
pwdMustChange: TRUE

In my ldap client I have set:
pam_lookup_policy yes

Do I have to change something in PAM?

Thanks in advance!

On 08/29/2012 03:59 PM, Guillaume Rousse wrote:
> Le 29/08/2012 20:52, cbulist a écrit :
> > Thanks Clement and Guillaume for your reply.
> >
> > This is my operational attributes for my user:
> >
> > dn: cn=user1,ou=policies,dc=samle,dc=com
> > objectClass: pwdPolicy
> > objectClass: top
> > objectClass: shadowAccount
> > objectClass: inetOrgPerson
> > objectClass: organizationalPerson
> > objectClass: person
> > cn: user1
> > pwdAttribute: userPassword
> > sn: user1
> > uid: user1
> > pwdAllowUserChange: TRUE
> > pwdExpireWarning: 10
> > pwdLockout: TRUE
> > pwdMaxAge: 15
> > pwdMustChange: TRUE
> Those are plain attributes, not *operational* attributes.
>
> > Guillaume:
> > I know that my access configuration is dangereous but how I am testing I
> > just want to be sure don't block anything.
> > If I understood your concept I can't use pwdPolicy for unix account. Is
> > there any way to control password history with shadowAccount?..
> Not with shadowAccount, but with password policy. Just create a 
> pwdPolicy object, instance of pwdPolicy class, and apply it to either 
> all your users, through slapd.conf ppolicy_default setting, or just to 
> some of your users, through its operational pwdPolicySubentry attribute.
>
> Basically, you should have distinct user and policy objects, such as:
>
> dn: cn=user1,ou=users,dc=samle,dc=com
> objectClass: shadowAccount
> objectClass: inetOrgPerson
> objectClass: organizationalPerson
> objectClass: person
> cn: user1
> sn: user1
> uid: user1
> userPassword: XXXX
>
> dn: cn=default,ou=policies,dc=samle,dc=com
> objectClass: pwdPolicy
> objectClass: top
> pwdAllowUserChange: TRUE
> pwdExpireWarning: 10
> pwdLockout: TRUE
> pwdMaxAge: 15
> pwdMustChange: TRUE