[Date Prev][Date Next] [Chronological] [Thread] [Top]

can't delete userPassword when ppolicy is used



openldap-2.3.30

Not sure if this it intended or not, but it seems to be impossible to delete 
the userPassword attribute from an entry if the ppolicy overlay is loaded.

I found this out when I accidentally added a userPassword attribute to a 
posixGroup entry and discovered I could no longer remove it:

$ ldapmodify -x -D cn=manager,dc=example,dc=com -w secret
dn: cn=ldapusers,ou=group,dc=example,dc=com
changetype: modify
delete: userpassword

modifying entry "cn=ldapusers,ou=group,dc=example,dc=com"
ldap_modify: Internal (implementation specific) error (80)
        additional info: Internal Error


If I unload the ppolicy overlay, the operation succeeds.

I have a default policy set which only specified the password attribute:
$ ldapsearch -x -LLL -b "ou=Password Policies,dc=example,dc=com"
dn: ou=Password Policies,dc=example,dc=com
ou: Password Policies
objectClass: organizationalUnit
description: Container for OpenLDAP password policies

dn: cn=default,ou=Password Policies,dc=example,dc=com
cn: default
objectClass: pwdPolicy
objectClass: namedObject
pwdAttribute: userPassword