0

I have a functional password policy in my OpenLDAP server. However, I just tried testing out the pwdInHistory property and it does not seem to prevent me from using the previous password I had just set.

For reference, part of my OpenLDAP server's policy is to not allow any cleartext passwords be set, so all of our passwords are set using SSHA from slappasswd.

I set pwdInHistory to 3, a relatively short number to test with first. I only bind as the user that is updating their password and not the LDAP root DN. Anyone have any ideas why this is not functioning the way I set up the password policy?

2
  • Just a few tests. After user X changes hits own password via ldappasswd, can you ldapsearch ... uid=X + (+ is operational attrs). It should show a pwdHistory attribute.
    – 473183469
    Jan 25, 2017 at 10:19
  • I'm not certain if it makes a difference, but I have been using ldapmodify to change passwords. After the password change, ldapsearch binding as that user with the new password works fine.
    – OhaiMac
    Jan 25, 2017 at 14:59

2 Answers 2

0

ppolicy overlay requires a ldappasswd (LDAPv3 Password Modify (RFC 3062) extended operation).

In order to trigger the controls ppolicy performs, the password change has to be issued with ldappasswd.

Other password modify commands do work, as long as you check if password changed, but won't be subject to ppolicy rulings.

0
0

To make pwdInHistory work fine you must provide password in plain text not in encrypted format. You can do that with ldappasswd or any another way (throug LDIF for example). The reason is simply it's impossible for the ppolicy overlay to know what password you have used (SSHA is not reversible). Providing password in plain text over TLS/SSL session is safe and not a security issue. But you have to activate encrypted storage of it (set olcPPolicyHashCleartext to TRUE)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .