[Date Prev][Date Next]
RE: (ITS#7228) Authentication Problem When Using PPolicy and Chaining
I believe the test is incorrect. Near the bottom of the script, there
is this section of code:
$LDAPSEARCH -H $URI2 -D "$USER" -w wrongpw >$SEARCHOUT 2>&1
$LDAPSEARCH -H $URI1 -D "$MANAGERDN" -w $PASSWD -b "$USER" \* \+ >>
COUNT=`grep "pwdFailureTime" $SEARCHOUT | wc -l`
echo "jkl 13"
if test $COUNT != 1 ; then
echo "Policy state forwarding failed"
test $KILLSERVERS != no && kill -HUP $KILLPIDS
The first LDAPSEARCH should have its return code checked, and for an
incorrect password, it should be 49. If the script is modified to check
for 49 and fail otherwise, it will fail.
Unfortunately, I am not in a position to use a newer version of
OpenLDAP, but I will build it and run the tests to see if the problem
exists there as well.
I will report back with my findings.
Division of Information Systems
Virginia Department of Social Services
From: Howard Chu [mailto:firstname.lastname@example.org]
Sent: Thursday, April 05, 2012 10:17 AM
To: Limb, Jong (VDSS)
Subject: Re: (ITS#7228) Authentication Problem When Using PPolicy and
> Full_Name: Jong K. Limb
> Version: 2.4.23
> OS: RHEL 5.3
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (188.8.131.52)
> I have the following setup:
> - Provider LDAP server used only by those applications that change
> - Consumer LDAP servers used by all applications that want to
> - The provider and consumers have password policy configured so that
> accounts lock after 3 failed attempts
> - In order to maintain synchronization of failed login attempts across
> consumers, I also enabled chaining from the consumers to the master
> If an attempt is made to authenticate against the consumer with an
> password (for example, using ldapsearch), the pwdFailureTime attribute
> added/updated on the provider and eventually synced to the consumer,
> operation succeeds when it should not have.
> If I remove the password policy overlay (leaving all other
> same) and run ldapsearch with an invalid password against a consumer,
> operation will fail with invalid credentials as it should.
> I have done a little debugging, and it looks like the response that
> returned to the client is the response to the modify operation that
> makes to the provider to add/update the pwdFailureTime attribute, and
> response to the bind operation. The modify operation is successful
here, so the
> client continues on with the search or other operation.
Unable to confirm this. Note that this is tested explicitly in test022
test suite, and no such behavior occurs there.
You're running a pretty old release, perhaps you should update.
unless you can provide more details to reproduce this situation, this
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/