I don't post often so it seems I attached this to an old thread. Sorry
I'm using ds-389 (Version 18.104.22.168; Build number 2015.343.1254) on a
CentOS 7 Server (release 7.4.1708). A week ago I performed a "yum
update" on my system
and now I'm finding that I can't update (or set) user passwords using
the "passwd" or "ldappasswd" commands when the "Password
Check password syntax)
policies are enabled.
I can authenticate fine to a server which is slaved into the ds-389
server, but issuing the command "passwd" gives the following error:
Changing password for user jdow.
(current) LDAP Password:
Retype new password:
password change failed: Constraint violation
passwd: Authentication token manipulation error
Likewise, I use to be able to run the following command to update a
user's password from a server:
ldappasswd -h themaster -p 389 -ZZ -D "cn=Directory Manager" -w
AdminsPassword -s 'UserPassword'
This command now fails with the erro
Result: Constraint violation (19
Additional info: Failed to update password
I had a password policy enabled on my domain subtree but I removed it.
I then went under "Configuration --> Data" and tried to configure a global
password policy instead. Each result in the same errors shown above
whenever I try to enable "Check password syntax".
There's not a great deal of info in /var/log/dirsrv, but in the access
file I see the following when I run the ldappasswd command:
[14/May/2018:10:37:03.173038139 -0600] conn=104 fd=110 slot=110
connection from 172.18.194.60 to 172.18.194.4
[14/May/2018:10:37:03.173283856 -0600] conn=104 op=0 EXT
[14/May/2018:10:37:03.173454544 -0600] conn=104 op=0 RESULT err=0
tag=120 nentries=0 etime=0
[14/May/2018:10:37:03.267493753 -0600] conn=104 TLS1.2 256-bit AES
[14/May/2018:10:37:03.267938436 -0600] conn=104 op=1 BIND
dn="cn=Directory Manager" method=128 version=3
[14/May/2018:10:37:03.268224050 -0600] conn=104 op=1 RESULT err=0 tag=97
nentries=0 etime=0 dn="cn=directory manager"
[14/May/2018:10:37:03.268672168 -0600] conn=104 op=2 EXT
[14/May/2018:10:37:03.269346086 -0600] conn=104 op=2 RESULT err=19
tag=120 nentries=0 etime=0
[14/May/2018:10:37:03.269832211 -0600] conn=104 op=3 UNBIND
[14/May/2018:10:37:03.269850488 -0600] conn=104 op=3 fd=110 closed - U1
Which looks like it must be failing when the passwd_modify_plugin is run.
I noticed in /etc/dirsrv/slapd-myserver that there were new schema ldif
files added during the yum update and I'm wondering if one is stepping
on my password
I'm going to try to remove them from the directory (and store them
elsewhere) to see if the issue disappears, but I'd rather not use a
hammer to fix a problem.
(update: Removing the new .ldif files made no difference in the behavior)
I'm grateful for any suggestions.
Show replies by thread
I think I found the issue.
From the thread: "As an example, a token length of 3 would mean that the following
tokens are not allowed in a password for a user with a uid of "nkinder":
I was testing with a default user and may have accidentally run into this issue. I
increased the token to 6 and the error *seemed to* vanish. Doing testing now.