ppolicy

[Frank Swasey]

We are setting up a new service that is going to actually hold passwords
in the OpenLDAP database instead of using Kerberos (via sasl and
saslauthd). To that end, I'm investigating ppolicy.

However, what I haven't found in the man page (slapo-ppolicy), or the
Admin Guide, or the FAQ-O-Matic is whether I need to configure ppolicy
on the master and the replicas or just the master.

My assumption is that I need to set up ppolicy on the replicas as well
as the master -- otherwise those pwd* operational attributes are not
going to be legal on the replica and I'll get in trouble. I haven't set
up a test environment with a replica yet -- so, I'm asking here.

I also see in the FAQ that ppolicy only works on OpenLDAP versions
greater than 2.3 (item 2 of the ppolicy checklist). So, I'm sensing
that ppolicy in OpenLDAP v2.3.x is not really completely functional? Am
I reading too much into the entry in the FAQ?

[Buchan Milne]

Post by Frank Swasey
We are setting up a new service that is going to actually hold passwords
in the OpenLDAP database instead of using Kerberos (via sasl and
saslauthd). To that end, I'm investigating ppolicy.
However, what I haven't found in the man page (slapo-ppolicy), or the
Admin Guide, or the FAQ-O-Matic is whether I need to configure ppolicy
on the master and the replicas or just the master.

Both. Ignoring the "upstream" replication of state attributes, to use ppolicy
effectively at all, any server which receives simple binds must have ppolicy
active.

Post by Frank Swasey
My assumption is that I need to set up ppolicy on the replicas as well
as the master -- otherwise those pwd* operational attributes are not
going to be legal on the replica and I'll get in trouble.

I think have ppolicy schema loaded would be sufficient to allow the attributes,
but do you want DNs that have been locked out to be able to authenticate on
your replicas? If not, you need ppolicy active on them.

Post by Frank Swasey
I haven't set
up a test environment with a replica yet -- so, I'm asking here.
I also see in the FAQ that ppolicy only works on OpenLDAP versions
greater than 2.3 (item 2 of the ppolicy checklist). So, I'm sensing
that ppolicy in OpenLDAP v2.3.x is not really completely functional? Am
I reading too much into the entry in the FAQ?

ppolicy does work on 2.3.x. However, the recent ppolicy_forward_updates option
on replicas (since 2.4.17 I think) may make things quite a bit easier.


Regards,
Buchan

[Ralf Haferkamp]

Hi,

Post by Frank Swasey
We are setting up a new service that is going to actually hold
passwords in the OpenLDAP database instead of using Kerberos (via
sasl and saslauthd). To that end, I'm investigating ppolicy.
However, what I haven't found in the man page (slapo-ppolicy), or the
Admin Guide, or the FAQ-O-Matic is whether I need to configure ppolicy
on the master and the replicas or just the master.
My assumption is that I need to set up ppolicy on the replicas as well
as the master -- otherwise those pwd* operational attributes are not
going to be legal on the replica and I'll get in trouble. I haven't
set up a test environment with a replica yet -- so, I'm asking here.

Yes you have to set it up on every server.

Post by Frank Swasey
I also see in the FAQ that ppolicy only works on OpenLDAP versions
greater than 2.3 (item 2 of the ppolicy checklist). So, I'm sensing
that ppolicy in OpenLDAP v2.3.x is not really completely functional?

Hm, to my knowledge ppolicy was working fine with 2.3.x. But if you are
setting up a new service it would be wise to go with the latest stable
release IMO.

Post by Frank Swasey
Am I reading too much into the entry in the FAQ?

Hm, I think that entry it's plain wrong. Unless somebody else vetos I am
going to remove that entry.