Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a custom application that's using openldap (2.4.32) as a user database. Per customer requirement, I'm modifying it to use openldap's ppolicy overlay. The requirement is to force the user to change their password when first created or after admin password resets. After activating and configuring the overlay and its default policy, I see the new hidden fields getting added to my objects to track the password expiration, but I can't seem to get pwdMustChange and pwdReset to work.

Here's my overlay config:

MBP2:~ me$ ldapsearch -h 10.242.25.158 -D "cn=root,cn=config" -x -W -b "cn=config" -s  sub "olcOverlay=ppolicy"
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <cn=config> with scope subtree
# filter: olcOverlay=ppolicy
# requesting: ALL
#

# {1}ppolicy, {1}bdb, config
dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: {1}ppolicy
olcPPolicyDefault: cn=default,ou=policies,dc=my,dc=domain,dc=com

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

And the default pwdPolicy object:

MBP2:~ me$ ldapsearch -h 10.242.25.158 -D "cn=ldapadmin,dc=my,dc=domain,dc=com" -x -W -b "ou=policies,dc=my,dc=domain,dc=com" -s sub "cn=default"
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <ou=policies,dc=my,dc=domain,dc=com> with scope subtree
# filter: cn=default
# requesting: ALL
#

# default, policies, my.domain.com
dn: cn=default,ou=policies,dc=my,dc=domain,dc=com
objectClass: person
objectClass: top
objectClass: pwdPolicy
cn: default
pwdAllowUserChange: TRUE
pwdAttribute: 2.5.4.35
pwdCheckQuality: 2
pwdExpireWarning: 600
pwdFailureCountInterval: 30
pwdGraceAuthNLimit: 5
pwdInHistory: 5
pwdLockout: TRUE
pwdLockoutDuration: 0
pwdMaxAge: 0
pwdMaxFailure: 5
pwdMinAge: 0
pwdMinLength: 5
pwdMustChange: TRUE
pwdSafeModify: TRUE
sn: dummy value

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

And a user created after adding the ppolicy module. After some googling, I manually set the pwdReset:TRUE to try and force the password to expire.

MBP2:~ cwikj$ ldapsearch -h 10.242.25.158 -D "cn=ldapadmin,dc=my,dc=domain,dc=com" -x -W -b "dc=my,dc=domain,dc=com" -s sub "uid=cs_j0000000002" +
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <dc=my,dc=domain,dc=com> with scope subtree
# filter: uid=cs_j0000000002
# requesting: + 
#

# CS_J0000000002, identities, A63562018398.my.domain.com
dn: uid=CS_J0000000002,ou=identities,dc=A63562018398,dc=my,dc=domain,dc=com
structuralObjectClass: customIdentity
entryUUID: 2569c9a5-ba99-4275-85b4-50974e57c2ee
creatorsName: cn=ldapadmin,dc=my,dc=domain,dc=com
createTimestamp: 20121004201108Z
pwdChangedTime: 20121004201108Z
pwdReset: TRUE
entryCSN: 20121004211150.015110Z#000000#000#000000
modifiersName: cn=ldapadmin,dc=my,dc=domain,dc=com
modifyTimestamp: 20121004211150Z
entryDN: uid=CS_J0000000002,ou=identities,dc=A63562018398,dc=my,dc=domain,dc=com
subschemaSubentry: cn=Subschema
hasSubordinates: FALSE

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

After all that, I try binding, but don't get a password expiration message.

MBP2:~ me$ ldapwhoami -h 10.242.25.158 -v -x -W -D "uid=CS_J0000000002,ou=identities,dc=A63562018398,dc=my,dc=domain,dc=com"
ldap_initialize( ldap://10.242.25.158 )
Enter LDAP Password:
dn:uid=CS_J0000000002,ou=identities,dc=A63562018398,dc=my,dc=domain,dc=com
Result: Success (0)

How can I get the password to expire? Is there something in the default policy that's conflicting with pwdReset: TRUE?

share|improve this question
    
I've been having the same issues as you except I can't even set the pwdReset field. How did you set it? I was using Apache DS and it says that the current schema prohibits that attribute. Maybe I'm not doing it with the 'right' user. What makes a user an admin user in ldap? –  Jerry Saravia Jan 18 '13 at 2:56

1 Answer 1

To see additional information from ppolicy, you have to request the extension explicitly.

For ldapsearch(1), ldapwhoami(1), and friends, you do that with -e ppolicy:

$ ldapwhoami -x -D uid=me,ou=users,dc=example,dc=org -W -e ppolicy -v
ldap_initialize( <DEFAULT> )
Enter LDAP Password: 
ldap_bind: Success (0); Password must be changed
dn:uid=me,ou=users,dc=example,dc=org
Result: Success (0)

For your application, it depends on the particular library you're using. The code for the C api, for example, is here. (I didn't find manpage for it, sorry.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.