[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: ppolicy - getting to work

Thanks again. Makes sense.

Now that I am locked out for SSH access, I will just ask questions of
interest without actually trying things out. For all the different
ppolicy-related things to work, I am guessing the following is the
procedure. Please correct me.

a) Editing slapd.conf and adding "include", "modulepath", "loadmodule
ppolicy.la", "overlay", "ppolicy_use_lockout", "ppolicy_default"
b) Adding necessary policy-related objects to LDAP (policy object and
standard policy sub-object). These will inherit from pwdPolicy
c) Adding the users that will be managed by the password policy to the
directory. Do I have to add "objectClass=pwdPolicy" attribute to all the
users that need to be managed by ppolicy and leave it out for the other

I will try all these out on monday.


>>> Aaron Richton <richton@nbcs.rutgers.edu> 11/24/06 8:06 PM >>>
Note that I build static modules, so this may need 
verification/clarification, but I'll try:

The .la files are libtool archives. If you examine them (e.g. cat(1)), 
then you'll see that they point to .so files (among other details). A 
libtool-aware application--note that slapd(8) should be one of them--can

parse the .la file, which allegedly offers advantages (mostly platform 
independence). So, following a 'make install', you should be able to 
specify in slapd.conf

> moduleload /path/to/ppolicy.la

and that should parse OK. At least, that's the way I remember it...

Then again, you should be able to moduleload the .so also. If the .la 
doesn't work out, try that.

On Fri, 24 Nov 2006, Prakash Velayutham wrote:

> Thanks Aaron. So I built openldap with:
> $ ./configure --with-tls=no --with-cyrus-sasl=no --enable-slurpd=no
> --enable-ipv6=no --enable-ppolicy=mod --enable-hdb=yes
> --enable-bdb=no --enable-ldif=no --enable-monitor=no --enable-relay=no
> --enable-syncprov=no
> Why do I have a ppolicy*.so and a ppolicy*.la file in the install
> location? When do you use the ppolicy*.so?
> I have temporarily lost access to the system because of PAM. Will have
> access again on monday.
> Thanks,
> Prakash
>>>> Prakash Velayutham 11/24/06 5:13 PM >>>
>>>> Aaron Richton <richton@nbcs.rutgers.edu> 11/24/06 4:04 PM >>>
> configure --enable-hdb --enable-ppolicy={yes|mod} should handle it.
> "yes" will build it into slapd, "mod" will give you a module. (You can
> do
> the same for --enable-hdb.)
> On Fri, 24 Nov 2006, Prakash Velayutham wrote:
>> Hello All,
>> I am trying to get ppolicy working on my openldap-2.3.29 server. I
> want
>> this setup to work with hdb backend and either static or dynamic
> ppolicy
>> module. What compile time options would be sufficient?
>> Thanks,
>> Prakash