The server enforces the policy internally, and (at least in theory)
all the code paths
that modify passwords should be calling the same policy checking
function. So
ldappasswd, ldapmodify and the GUI should see exactly the same
policy.
If you turn up
the logging level you might see more interesting output (in the
errors
log, not the
access log, which is always quite terse).
I put "heavy logging on" but I can't see anything to do with password
policies (below is the trace from one ldappaswd update operation which
should have failed due to password policy). I also looked at the funtion
traces and there are calls to get the DNs of the policy object but no
errors or anything to say they were applied.
[12/Nov/2006:11:45:03 -0800] - do_extended: oid
(1.3.6.1.4.1.1466.20037-startTLS)
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - do_extended: oid
(1.3.6.1.4.1.4203.1.11.1-passwd_modify_extop)
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend : userRoot
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - replace: userpassword
[12/Nov/2006:11:45:03 -0800] - removing entire attribute userpassword
[12/Nov/2006:11:45:03 -0800] - userpassword:
{SSHA}W4FdKGuc/MmN3w8f98UgmtyMaWH0Hn1GMM/LhA==
[12/Nov/2006:11:45:03 -0800] - -
[12/Nov/2006:11:45:03 -0800] - replace: modifiersname
[12/Nov/2006:11:45:03 -0800] - removing entire attribute modifiersname
[12/Nov/2006:11:45:03 -0800] - modifiersname:
cn=server,cn=plugins,cn=config
[12/Nov/2006:11:45:03 -0800] - -
[12/Nov/2006:11:45:03 -0800] - replace: modifytimestamp
[12/Nov/2006:11:45:03 -0800] - removing entire attribute modifytimestamp
[12/Nov/2006:11:45:03 -0800] - modifytimestamp: 20061112194503Z
[12/Nov/2006:11:45:03 -0800] - -
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:03 -0800] - replace: passwordgraceusertime
[12/Nov/2006:11:45:03 -0800] - removing entire attribute
passwordgraceusertime
[12/Nov/2006:11:45:03 -0800] - passwordgraceusertime: 0
[12/Nov/2006:11:45:03 -0800] - -
[12/Nov/2006:11:45:03 -0800] - replace: modifiersname
[12/Nov/2006:11:45:03 -0800] - removing entire attribute modifiersname
[12/Nov/2006:11:45:03 -0800] - modifiersname:
cn=server,cn=plugins,cn=config
[12/Nov/2006:11:45:03 -0800] - -
[12/Nov/2006:11:45:03 -0800] - replace: modifytimestamp
[12/Nov/2006:11:45:03 -0800] - removing entire attribute modifytimestamp
[12/Nov/2006:11:45:03 -0800] - modifytimestamp: 20061112194503Z
[12/Nov/2006:11:45:03 -0800] - -
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - SRCH base="" scope=0 deref=0 sizelimit=0
timelimit=600 attrsonly=0 filter="(objectClass=*)"
attrs="supportedControl supportedExtension"
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - SRCH base="" scope=0 deref=0 sizelimit=0
timelimit=600 attrsonly=0 filter="(objectClass=*)"
attrs="supportedControl supportedExtension"
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:03 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:04 -0800] - do_extended: oid
(2.16.840.1.113730.3.5.3-Netscape Replication Start Session)
[12/Nov/2006:11:45:04 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:04 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:04 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:04 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:04 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:04 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:04 -0800] - do_extended: oid
(2.16.840.1.113730.3.5.5-Netscape Replication End Session)
[12/Nov/2006:11:45:04 -0800] - mapping tree selected backend : userRoot
[12/Nov/2006:11:45:04 -0800] - indextype: "eq" indexmask: 0x2
[12/Nov/2006:11:45:04 -0800] - nsds50ruv: {replicageneration}
44a5cc86000000010000
[12/Nov/2006:11:45:04 -0800] - nsds50ruv: {replica 1
ldap://hqldap01.blah.com:389} 44a5ce65000000010000 45577d66000100010000
[12/Nov/2006:11:45:04 -0800] - nsds50ruv: {replica 2
ldap://ldap001.bo1.blah.hou:389} 44a5f47e000000020000
4553f30e000000020000
[12/Nov/2006:11:45:04 -0800] - replace: nsds50ruv
[12/Nov/2006:11:45:04 -0800] - -
[12/Nov/2006:11:45:04 -0800] - nsruvReplicaLastModified: {replica 1
ldap://hqldap01.blah.com:389} 455779bf
[12/Nov/2006:11:45:04 -0800] - nsruvReplicaLastModified: {replica 2
ldap://ldap001.bo1.blah.hou:389} 4553ef67
[12/Nov/2006:11:45:04 -0800] - replace: nsruvReplicaLastModified
[12/Nov/2006:11:45:04 -0800] - -
[12/Nov/2006:11:45:11 -0800] - do_modify: dn (cn=config)
[12/Nov/2006:11:45:11 -0800] - modifications:
[12/Nov/2006:11:45:11 -0800] - replace: nsslapd-errorlog-level
[12/Nov/2006:11:45:11 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:11 -0800] - mapping tree selected backend :
frontend-internal
[12/Nov/2006:11:45:11 -0800] - mapping tree release backend :
frontend-internal
[12/Nov/2006:11:45:11 -0800] - nsslapd-errorlog-level: 0
[12/Nov/2006:11:45:11 -0800] - replace: nsslapd-errorlog-level
[12/Nov/2006:11:45:11 -0800] - -
[12/Nov/2006:11:45:11 -0800] - modifiersname: cn=directory manager
[12/Nov/2006:11:45:11 -0800] - replace: modifiersname
[12/Nov/2006:11:45:11 -0800] - -
[12/Nov/2006:11:45:11 -0800] - modifytimestamp: 20061112194511Z
[12/Nov/2006:11:45:11 -0800] - replace: modifytimestamp
[12/Nov/2006:11:45:11 -0800] - -