On Thu, 2012-01-26 at 14:41 -0800, Eric wrote:
Hello,
I have searched for an appropriate list to post this question and
figured this was the best I could find and apologize in advance for the
wasted bandwidth and chatter. Just point me to the right direction.
Nope, you've come to the right place. We don't have a separate users
list.
I am trying to implement a password policy (i.e. password expiration
(max age), password history, etc) on RHEL 5. I am kind of at a loss. Is
there any plans to add functionality into sssd for RHEL5 that will give
this type of functionality? See below for details on what I have tried.
SSSD should already support this (to a certain extent).
I was hoping to use sssd with the backend of OpenLDAP 2.4.26 since this
is used extensively at my organization already.
I tried using the ppolicy overlay from OpenLDAP, but that does not
provide any feedback to the user about pending password expiration via
sssd.
Yes it does, though by default we don't report it unless the expiration
is fewer than seven days away. This is configurable with
pam_pwd_expiration_warning = N
Where N is the number of days in advance to warn.
So at the time and date of expiration, the user is unable to login
without any prior warning and is unable to login.
Instead I see the following in /var/log/sssd/sssd_LDAP.log
[sssd[be[LDAP]]] [sdap_control_create] (3): Server does not
support the requested control [1.3.6.1.4.1.42.2.27.8.5.1]. The above
apparently is the ldap contral which gives the warning about password
expiration which sssd does not see.
You're hitting
https://bugzilla.redhat.com/show_bug.cgi?id=748856 which
is fixed in RHEL 5.8 (and is available in the RHEL 5.8 beta right now).
We already support this control fully, but we had a bug where we weren't
properly detecting that the server supported it.
Any plans to update sssd for RHEL5 to support "Controls used for
Password Policy" found in
http://tools.ietf.org/html/draft-behera-ldap-password-policy-07.
I can provide more information upon request.
Any help with this would be greatly appreciated.