I implemented the password policy overlay in OpenLDAP 2.4.23. I am also using check_password.so for the passwordCheckModule. Its working fine for the single user but the thing is that cn=admin,dc=example,dc=com is able to change password of any user without checking the check_password.so. Admin is able to set any password.

Any body is having any idea regarding this then share..It will be very appreciated.


This is by design and can not be changed.

Quoting slapo-ppolicy(5):

   Note that some of the policies do not take effect when the operation is
   performed with the rootdn identity; all the operations, when  performed
   with  any  other identity, may be subjected to constraints, like access
| improve this answer | |

SvenW is correct in his answer, but there's more to it than that.

Modules which perform any sort of validation or manipulation of passwords when the password is changed can generally only work when using the password modify EXOP. When a password modify EXOP (extended operation) is performed, the plaintext password is given to OpenLDAP and OpenLDAP is responsible for hashing/encrypting it and storing that encrypted value. Thus OpenLDAP knows what the password really is.
Now, when the admin goes and changes the password, its not using a password modify EXOP, its likely setting the encrypted value directly. So OpenLDAP never knows what the unencrypted password is, and thus cant perform any sort of checks on it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.