Commit 16ff029f authored by Quanah Gibson-Mount's avatar Quanah Gibson-Mount
Browse files

ITS#5479

parent 172a9612
......@@ -46,9 +46,10 @@ OpenLDAP 2.4.9 Engineering
Documentation
Fixed slapd.access(5) authz-regexp documented behavior (ITS#5400)
Fixed slapd.meta(5) idassert-* documentation (ITS#5406)
admin24 delta-syncrepl documentation (ITS#5476)
admin24 set documentation (ITS#5278,ITS#5279,ITS#5281)
admin24 slapo-ppolicy documentation (ITS#5479)
admin24 syncrepl directives update (ITS#5425)
admin24 delta-syncrepl documentation (ITS#5476)
OpenLDAP 2.4.8 Release (2008/02/19)
Fixed ldapmodify verbose logging (ITS#5247)
......
personal_ws-1.1 en 1597
personal_ws-1.1 en 1598
commonName
bla
Masarati
subjectAltName
api
BhY
olcSyncRepl
olcSyncrepl
olcSyncRepl
adamsom
adamson
CER
......@@ -38,8 +38,8 @@ DIB
dev
reqNewSuperior
librewrite
memberof
memberOf
memberof
BSI
updateref
buf
......@@ -87,8 +87,8 @@ dlopen
eng
AttributeValue
attributevalue
DUA
EOF
DUA
inputfile
DSP
refreshDone
......@@ -123,10 +123,10 @@ iff
contextCSN
auditModify
auditSearch
OpenLDAP
openldap
resultcode
OpenLDAP
resultCode
resultcode
sysconfig
indices
blen
......@@ -159,13 +159,13 @@ argv
kdz
notAllowedOnRDN
hostport
StartTLS
starttls
StartTLS
ldb
servercredp
ldd
IPv
ipv
IPv
hyc
joe
bindmethods
......@@ -189,16 +189,16 @@ attrstyle
directoryOperation
creatorsName
mem
oldPasswdFile
oldpasswdfile
oldPasswdFile
uniqueMember
krb
libpath
acknowledgements
jts
createTimestamp
MIB
LLL
MIB
OpenSSL
openssl
LOF
......@@ -236,10 +236,10 @@ Subbarao
aeeiib
oidlen
submatches
PEM
olc
OLF
PEM
PDU
OLF
LDAPSchemaExtensionItem
auth
Pierangelo
......@@ -255,8 +255,8 @@ numattrsets
requestDN
caseExactSubstringsMatch
PKI
ple
olcSyncProvConfig
ple
NTP
auditModRDN
checkpointing
......@@ -277,9 +277,9 @@ rdn
wZFQrDD
OTP
olcSizeLimit
PRD
sbi
pos
sbi
PRD
pre
sudoadm
stringal
......@@ -297,8 +297,8 @@ sel
bvec
TBC
stringbv
SHA
Sep
SHA
ptr
conn
pwd
......@@ -315,8 +315,8 @@ myOID
supportedSASLMechanism
supportedSASLmechanism
realnamingcontext
UCD
SMD
UCD
keytab
portnumber
uncached
......@@ -329,8 +329,8 @@ sasldb
UCS
searchDN
keytbl
UDP
tgz
UDP
freemods
prepend
errText
......@@ -347,22 +347,22 @@ crit
objectClassViolation
ssf
ldapfilter
vec
TOC
rwm
TOC
vec
pwdChangedTime
tls
peernamestyle
xpasswd
SRP
tmp
SRP
SSL
dupbv
CPUs
SRV
entrymods
sss
rwx
sss
reqNewRDN
nopresent
rebindproc
......@@ -419,8 +419,8 @@ pwdMaxFailure
pseudorootdn
GDBM
LIBRELEASE
DSA's
DSAs
DSA's
realloc
booleanMatch
compareTrue
......@@ -477,8 +477,8 @@ pwdMinLength
iZ
ldapdelete
xyz
rdbms
RDBMs
rdbms
extparam
mk
ng
......@@ -541,8 +541,8 @@ ZZ
LDVERSION
testAttr
backend
backends
backend's
backends
BerValues
Solaris
structs
......@@ -554,9 +554,9 @@ ostring
policyDN
testObject
pwdMaxAge
binddn
bindDN
bindDn
bindDN
binddn
distributedOperation
schemachecking
strvals
......@@ -598,14 +598,14 @@ IEEE
regex
SIGINT
slappasswd
errABsObject
errAbsObject
errABsObject
ldapexop
objectIdentifier
objectidentifier
objectIdentifier
deallocators
mirrormode
MirrorMode
mirrormode
loopDetect
SIGHUP
authMethodNotSupported
......@@ -622,8 +622,8 @@ filtercomp
expr
syntaxes
memrealloc
returncode
returnCode
returncode
OpenLDAP's
exts
bitstringa
......@@ -646,8 +646,8 @@ lastName
lldap
cachesize
slapauth
attributeType
attributetype
attributeType
GSER
olcDbNosync
typedef
......@@ -664,13 +664,13 @@ monitoredObject
TLSVerifyClient
noidlen
LDAPNOINIT
pwdGraceAuthNLimit
pwdGraceAuthnLimit
hnPk
userPassword
noanonymous
LIBVERSION
symas
Symas
dcedn
sublevel
chroot
......@@ -684,9 +684,9 @@ proxying
organisations
rewriteMap
monitoredInfo
modrDN
ModRDN
modrdn
ModRDN
modrDN
HREF
inline
multiproxy
......@@ -698,8 +698,8 @@ reqReferral
rlookups
siiiib
LTSTATIC
timelimitExceeded
timeLimitExceeded
timelimitExceeded
XKYnrjvGT
subtrees
unixODBC
......@@ -711,6 +711,7 @@ reqDN
dnstyle
inet
schemas
pwdPolicySubEntry
pwdPolicySubentry
reqId
scanf
......@@ -750,8 +751,8 @@ POSIX
pathname
noSuchObject
proxyOld
BerElement
berelement
BerElement
sbiod
plugin
http
......@@ -761,8 +762,8 @@ ldbm
numericStringSubstringsMatch
internet
storages
WhoAmI
whoami
WhoAmI
criticality
addBlanks
logins
......@@ -1029,8 +1030,8 @@ refreshAndPersist
authc
PENs
referralDN
noop
MANAGERDN
noop
errObject
XXLIBS
reqAssertion
......@@ -1551,8 +1552,8 @@ wBDARESEhgVG
multi
aaa
ldaprc
UpdateDN
updatedn
UpdateDN
LDAPBASE
LDAPAPIFeatureInfo
authzTo
......@@ -1593,6 +1594,6 @@ slimit
ali
attributeoptions
uidNumber
CA's
CAs
CA's
namingContext
......@@ -764,13 +764,112 @@ H2: Password Policies
H3: Overview
This overlay provides a variety of password control mechanisms,
e.g. password aging, password reuse and duplication control, mandatory
password resets, etc.
This overlay follows the specifications contained in the draft RFC titled
draft-behera-ldap-password-policy-09. While the draft itself is expired, it has
been implemented in several directory servers, including slapd. Nonetheless,
it is important to note that it is a draft, meaning that it is subject to change
and is a work-in-progress.
The key abilities of the password policy overlay are as follows:
* Enforce a minimum length for new passwords
* Make sure passwords are not changed too frequently
* Cause passwords to expire, provide warnings before they need to be changed, and allow a fixed number of 'grace' logins to allow them to be changed after they have expired
* Maintain a history of passwords to prevent password re-use
* Prevent password guessing by locking a password for a specified period of time after repeated authentication failures
* Force a password to be changed at the next authentication
* Set an administrative lock on an account
* Support multiple password policies on a default or a per-object basis.
* Perform arbitrary quality checks using an external loadable module. This is a non-standard extension of the draft RFC.
H3: Password Policy Configuration
Instantiate the module in the database where it will be used, after adding the
new ppolicy schema and loading the ppolicy module. The following example shows
the ppolicy module being added to the database that handles the naming
context "dc=example,dc=com". In this example we are also specifying the DN of
a policy object to use if none other is specified in a user's object.
> database bdb
> suffix "dc=example,dc=com"
> [...additional database configuration directives go here...]
>
> overlay ppolicy
> ppolicy_default "cn=default,ou=policies,dc=example,dc=com"
Now we need a container for the policy objects. In our example the password
policy objects are going to be placed in a section of the tree called
"ou=policies,dc=example,dc=com":
> dn: ou=policies,dc=example,dc=com
> objectClass: organizationalUnit
> objectClass: top
> ou: policies
The default policy object that we are creating defines the following policies:
* The user is allowed to change his own password. Note that the directory ACLs for this attribute can also affect this ability (pwdAllowUserChange: TRUE).
* The name of the password attribute is "userPassword" (pwdAttribute: userPassword). Note that this is the only value that is accepted by OpenLDAP for this attribute.
* The server will check the syntax of the password. If the server is unable to check the syntax (i.e., it was hashed or otherwise encoded by the client) it will return an error refusing the password (pwdCheckQuality: 2).
* When a client includes the Password Policy Request control with a bind request, the server will respond with a password expiration warning if it is going to expire in ten minutes or less (pwdExpireWarning: 600). The warnings themselves are returned in a Password Policy Response control.
* When the password for a DN has expired, the server will allow five additional "grace" logins (pwdGraceAuthNLimit: 5).
* The server will maintain a history of the last five passwords that were used for a DN (pwdInHistory: 5).
* The server will lock the account after the maximum number of failed bind attempts has been exceeded (pwdLockout: TRUE).
* When the server has locked an account, the server will keep it locked until an administrator unlocks it (pwdLockoutDuration: 0)
* The server will reset its failed bind count after a period of 30 seconds.
* Passwords will not expire (pwdMaxAge: 0).
* Passwords can be changed as often as desired (pwdMinAge: 0).
* Passwords must be at least 5 characters in length (pwdMinLength: 5).
* The password does not need to be changed at the first bind or when the administrator has reset the password (pwdMustChange: FALSE)
* The current password does not need to be included with password change requests (pwdSafeModify: FALSE)
* The server will only allow five failed binds in a row for a particular DN (pwdMaxFailure: 5).
The actual policy would be:
> dn: cn=default,ou=policies,dc=example,dc=com
> cn: default
> objectClass: pwdPolicy
> objectClass: person
> objectClass: top
> pwdAllowUserChange: TRUE
> pwdAttribute: userPassword
> pwdCheckQuality: 2
> pwdExpireWarning: 600
> pwdFailureCountInterval: 30
> pwdGraceAuthNLimit: 5
> pwdInHistory: 5
> pwdLockout: TRUE
> pwdLockoutDuration: 0
> pwdMaxAge: 0
> pwdMaxFailure: 5
> pwdMinAge: 0
> pwdMinLength: 5
> pwdMustChange: FALSE
> pwdSafeModify: FALSE
> sn: dummy value
You can create additional policy objects as needed.
There are two ways password policy can be applied to individual objects:
1. Default password policy - If, as in the example above, the password policy
module was configured with the DN of a default policy object and if that object
exists, then the policy defined in that object is applied.
2. The pwdPolicySubentry in a user's object - If a user's object contains a
value for the pwdPolicySubEntry attribute, and if that object exists, then
the policy defined by that object is applied. Remember that we need to add
object class pwdPolicy to the user's object as well.
Please see {{slapo-ppolicy(5)}} for complete explanations of features and discussion of
"Password Management Issues" at {{URL:http://www.connexitor.com/forums/viewtopic.php?f=6&t=25}}
H2: Referential Integrity
......@@ -924,7 +1023,7 @@ H3: Overview
Overlays can be stacked, which means that more than one overlay
can be instantiated for each database, or for the {{EX:frontend}}.
As a consequence, each overlay's function is called, if defined,
As a consequence, each overlays function is called, if defined,
when overlay execution is invoked.
Multiple overlays are executed in reverse order (as a stack)
with respect to their definition in slapd.conf (5), or with respect
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment