Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm going to integrate the check_mk's Multisite with OpenLDAP. After configuring the LDAP connector, I get the following error when opening the "Users & Contacts" page:

Error executing sync hook
The "Authentication Expiration" attribute (pwdchangedtime) could not
be fetchedfrom the LDAP server for user {u'cn': [u'noreply']}.

Here're all the steps that I've done to implement the Password Policy Overlay:

Install overlay modules for OpenLDAP server:

yum install openldap-servers-overlays

Add the following lines to /etc/openldap/slapd.conf:

include     /etc/openldap/schema/ppolicy.schema

modulepath  /usr/lib64/openldap

then I restart the OpenLDAP and try to change the password. I'm sure it's changed successfully but I don't see the pwdChangedTime attribute when running a ldapsearch:

$ ldapsearch -x -D "cn=Manager,dc=domain,dc=com" -y .passwd.cnf "cn=noreply"
dn: cn=noreply,ou=it,dc=domain,dc=com
cn: noreply
mail: noreply at
maildrop: noreply at
sn: No
uid: noreply
objectClass: inetOrgPerson
objectClass: mailUser
objectClass: organizationalPerson
objectClass: person
objectClass: top
objectClass: pwdPolicy
objectClass: pwdPolicyChecker
pwdAttribute: userPassword
pwdMaxAge: 31536000
pwdMinAge: 60
pwdAllowUserChange: TRUE
userPassword: {MD5}xx

Did I miss something?

share|improve this question
up vote 4 down vote accepted

Actually, the pwdChangedTime attribute is already created but since it is an operational attribute, it is not returned by default. You have to do a ldapsearch with this name:

$ ldapsearch -x -D "cn=Manager,dc=domain,dc=com" -W "cn=noreply"
Enter LDAP Password:
# extended LDIF
# LDAPv3
# base <> with scope subtree
# filter: cn=noreply
# requesting: pwdChangedTime

# noreply, it,
dn: cn=noreply,ou=it,dc=domain,dc=com
pwdChangedTime: 20130128154849Z

or append the plus (+) to the ldapsearch:

# ldapsearch -x -D "cn=Manager,dc=domain,dc=com" -y .passwd.cnf "cn=noreply" +
# extended LDIF
# LDAPv3
# base <> with scope subtree
# filter: cn=noreply
# requesting: + 

# noreply, it,
dn: cn=noreply,ou=it,dc=domain,dc=com
structuralObjectClass: inetOrgPerson
entryUUID: 047e7ce6-3b99-1031-83cb-afef2344189c
creatorsName: cn=Manager,dc=domain,dc=com
createTimestamp: 20120526161012Z
pwdChangedTime: 20130129032710Z
entryCSN: 20130129032710Z#00003a#00#000000
modifiersName: cn=Manager,dc=domain,dc=com
modifyTimestamp: 20130129032710Z
entryDN: cn=noreply,ou=it,dc=domain,dc=com
subschemaSubentry: cn=Subschema
hasSubordinates: FALSE

To add this attribute to the all users which are created before implementing Password Policy Overlay, you can simply update the userPassword with the same value:

ldapsearch -x -D cn=Manager,dc=domain,dc=com -W -y .passwd.txt -L
"(&(objectclass=person)(!(pwdChangedTime=*)))" userPassword
     | sed '/dn: /a\changetype: modify\nreplace: userPassword'
         | ldapmodify -x -D cn=Manager,dc=domain,dc=com -y .passwd.txt -W
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.