I've set up an LDAP server with the ppolicy overlay, but now am having trouble resetting user's password in some cases: if the user has a failed login, then the pwdFailureTime attribute exists and ldapmodify fails complaining that it doesn't.
If my most recent log-in attempt was successful, then I can bind as cn=admin and run the ldif file:
dn: uid=anton,ou=accounts,dc=[redacted],dc=ca changetype: modify replace: userPassword userPassword: foobar - replace: pwdReset pwdReset: TRUE
which succeeds. However, if the last log-in attempt was with a wrong password, ppolicy adds a pwdFailureTime attribute to the account, and then trying to run the ldif file above results in:
$ ldapmodify -x -D "cn=admin,dc=[redacted],dc=ca" -W -H ldap:// -f pwreset.ldif Enter LDAP Password: modifying entry "uid=anton,ou=accounts,dc=[redacted],dc=ca" ldap_modify: No such attribute (16) additional info: modify/delete: pwdFailureTime: no such attribute
If I try deleting the pwdFailureTime attribute before resetting the password, then I get:
ldap_modify: Constraint violation (19) additional info: pwdFailureTime: no user modification allowed
In real life, if a user's forgotten their password and needs it reset, they will generally have tried to recall the password several times, so will have the pwdFailureTime attribute set. Any suggestions?