ITS#6168 actually use pwdLockout setting

CHANGES

@@ -44,6 +44,7 @@ OpenLDAP 2.4.17 Engineering
 	Fixed slapo-collect missing equality match rule (ITS#6075)
 	Fixed slapo-dds entry expiration (ITS#6169)
 	Fixed slapo-perl symbols (ITS#5658)
+	Fixed slapo-ppolicy to honor pwdLockout (ITS#6168)
 	Fixed slapo-refint refint_repair handling (ITS#6056)
 	Added slapo-rwm rwm-drop-unrequested-attrs config option (ITS#6057)
 	Fixed slapo-rwm dn passing (ITS#6070)

servers/slapd/overlays/ppolicy.c

@@ -324,6 +324,9 @@ account_locked( Operation *op, Entry *e,
 
 	assert(mod != NULL);
 
+	if ( !pp->pwdLockout )
+		return 0;
+
 	if ( (la = attr_find( e->e_attrs, ad_pwdAccountLockedTime )) != NULL ) {
 		BerVarray vals = la->a_nvals;
 

tests/data/ppolicy.ldif

@@ -33,6 +33,7 @@ pwdMustChange: TRUE
 pwdMaxFailure: 3
 pwdFailureCountInterval: 120
 pwdSafeModify: TRUE
+pwdLockout: TRUE
 
 dn: uid=nd, ou=People, dc=example, dc=com
 objectClass: top