Re: SASL not honoring slapo-ppolicy

[Howard Chu <hyc@symas.com>]

Achilleas Mantzios wrote:
> Hello list,
> I have managed successfully to setup a fully functional openldap server on FreeBSD.
> So far, I had success with : ppolicy, ACLs, legacy SQL exposed as LDAP, SASL authentication.
> My only problem thus far is combining SASL with ppolicy. When binding with classic simple
> authentication using -D dn, then ppolicy overlay has the expected effect.
> However when using SASL (SASL/SCRAM-SHA-1) with -U, while it works correctly converting uid to DN
> with authz-regexp, it does not seem to look for ppolicy (default or derived from pwdPolicySubentry).
> Moreover, enforced violations of ppolicy (e.g. failed attempted authentications >= pwdMaxFailure)
> when done via SASL seem to have no effect on ppolicy attributes, e.g. pwdAccountLockedTime,
> while they work fine when binding with simple authentication.
>
> Is there any way to overcome this? Or is ppolicy honored only via simple DN binds?

ppolicy is only honored by Simple Binds. There was some discussion, a long 
time ago, about how to make SASL use/recognize LDAP password policy, but it 
never went anywhere.

--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/