I have a functional password policy in my OpenLDAP server. However, I just tried testing out the pwdInHistory
property and it does not seem to prevent me from using the previous password I had just set.
For reference, part of my OpenLDAP server's policy is to not allow any cleartext passwords be set, so all of our passwords are set using SSHA from slappasswd.
I set pwdInHistory
to 3, a relatively short number to test with first. I only bind as the user that is updating their password and not the LDAP root DN. Anyone have any ideas why this is not functioning the way I set up the password policy?
ldappasswd
, can youldapsearch ... uid=X +
(+ is operational attrs). It should show apwdHistory
attribute.