Hi,
I don't post often so it seems I attached this to an old thread.
Sorry folks.
I'm using ds-389 (Version 1.3.4.0; Build number 2015.343.1254) on a
CentOS 7 Server (release 7.4.1708). A week ago I performed a "yum
update" on my system
and now I'm finding that I can't update (or set) user passwords
using the "passwd" or "ldappasswd" commands when the "Password
Syntax" (i.e. Check password syntax)
policies are enabled.
I can authenticate fine to a server which is slaved into the ds-389
server, but issuing the command "passwd" gives the following error:
--$ passwd
Changing password for user jdow.
(current) LDAP Password:
New password:
Retype new password:
password change failed: Constraint violation
passwd: Authentication token manipulation error
Likewise, I use to be able to run the following command to update a
user's password from a server:
ldappasswd -h themaster -p 389 -ZZ -D "cn=Directory
Manager" -w AdminsPassword -s 'UserPassword'
"uid=jdoe,ou=People,dc=mydomain,dc=edu"
This command now fails with the erro
Result: Constraint violation (19
Additional info: Failed to update password
I had a password policy enabled on my domain subtree but I removed
it. I then went under "Configuration --> Data" and tried to
configure a global
password policy instead. Each result in the same errors shown
above whenever I try to enable "Check password syntax".
There's not a great deal of info in /var/log/dirsrv, but in the
access file I see the following when I run the ldappasswd command:
[14/May/2018:10:37:03.173038139 -0600] conn=104 fd=110 slot=110
connection from 172.18.194.60 to 172.18.194.4
[14/May/2018:10:37:03.173283856 -0600] conn=104 op=0 EXT
oid="1.3.6.1.4.1.1466.20037" name="start_tls_plugin"
[14/May/2018:10:37:03.173454544 -0600] conn=104 op=0 RESULT err=0
tag=120 nentries=0 etime=0
[14/May/2018:10:37:03.267493753 -0600] conn=104 TLS1.2 256-bit AES
[14/May/2018:10:37:03.267938436 -0600] conn=104 op=1 BIND
dn="cn=Directory Manager" method=128 version=3
[14/May/2018:10:37:03.268224050 -0600] conn=104 op=1 RESULT err=0
tag=97 nentries=0 etime=0 dn="cn=directory manager"
[14/May/2018:10:37:03.268672168 -0600] conn=104 op=2 EXT
oid="1.3.6.1.4.1.4203.1.11.1" name="passwd_modify_plugin"
[14/May/2018:10:37:03.269346086 -0600] conn=104 op=2 RESULT err=19
tag=120 nentries=0 etime=0
[14/May/2018:10:37:03.269832211 -0600] conn=104 op=3 UNBIND
[14/May/2018:10:37:03.269850488 -0600] conn=104 op=3 fd=110 closed -
U1
Which looks like it must be failing when the passwd_modify_plugin is
run.
I noticed in /etc/dirsrv/slapd-myserver that there were new schema
ldif files added during the yum update and I'm wondering if one is
stepping on my password
policy.
I'm going to try to remove them from the directory (and store them
elsewhere) to see if the issue disappears, but I'd rather not use a
hammer to fix a problem.
(update: Removing the new .ldif files made no difference in the
behavior)
I'm grateful for any suggestions.
Thanks,