Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I implemented the password policy overlay in OpenLDAP 2.4.23. I am also using for the passwordCheckModule. Its working fine for the single user but the thing is that cn=admin,dc=example,dc=com is able to change password of any user without checking the Admin is able to set any password.

Any body is having any idea regarding this then share..It will be very appreciated.

share|improve this question

This is by design and can not be changed.

Quoting slapo-ppolicy(5):

   Note that some of the policies do not take effect when the operation is
   performed with the rootdn identity; all the operations, when  performed
   with  any  other identity, may be subjected to constraints, like access
share|improve this answer

SvenW is correct in his answer, but there's more to it than that.

Modules which perform any sort of validation or manipulation of passwords when the password is changed can generally only work when using the password modify EXOP. When a password modify EXOP (extended operation) is performed, the plaintext password is given to OpenLDAP and OpenLDAP is responsible for hashing/encrypting it and storing that encrypted value. Thus OpenLDAP knows what the password really is.
Now, when the admin goes and changes the password, its not using a password modify EXOP, its likely setting the encrypted value directly. So OpenLDAP never knows what the unencrypted password is, and thus cant perform any sort of checks on it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.