I've set up an LDAP server with the ppolicy overlay, but now am having trouble resetting user's password in some cases: if the user has a failed login, then the pwdFailureTime attribute exists and ldapmodify fails complaining that it doesn't.
If my most recent log-in attempt was successful, then I can bind as cn=admin and run the ldif file:
dn: uid=anton,ou=accounts,dc=[redacted],dc=ca
changetype: modify
replace: userPassword
userPassword: foobar
-
replace: pwdReset
pwdReset: TRUE
which succeeds. However, if the last log-in attempt was with a wrong password, ppolicy adds a pwdFailureTime attribute to the account, and then trying to run the ldif file above results in:
$ ldapmodify -x -D "cn=admin,dc=[redacted],dc=ca" -W -H ldap:// -f pwreset.ldif
Enter LDAP Password:
modifying entry "uid=anton,ou=accounts,dc=[redacted],dc=ca"
ldap_modify: No such attribute (16)
additional info: modify/delete: pwdFailureTime: no such attribute
If I try deleting the pwdFailureTime attribute before resetting the password, then I get:
ldap_modify: Constraint violation (19)
additional info: pwdFailureTime: no user modification allowed
In real life, if a user's forgotten their password and needs it reset, they will generally have tried to recall the password several times, so will have the pwdFailureTime attribute set. Any suggestions?