Re: What is the option '-e ppolicy' ?

[Thierry Thelliez <thierry.thelliez.tech@gmail.com>]

I tried with and with the '-e ppolicy' option but that did not make a difference in terms of behavior. ÂIt did make a difference for the output message.

For: Â ldappasswd -x -w oldpassword -a oldpassword -s test -D "uid=aUser, ou=MyUsers, dc=xyz, dc=com" -e ppolicy

The output is:Â

Result: Constraint violation (19)

Additional info: Password fails quality checking policy

control: 1.3.6.1.4.1.42.2.27.8.5.1 false MAOBAQY=

ppolicy: error=6 (Password is too short for policy)Â

For: Â ldappasswd -x -w oldpassword -a oldpassword -s test -D "uid=aUser, ou=MyUsers, dc=xyz, dc=com"

The ouput is shorter:

Result: Constraint violation (19)

Additional info: Password fails quality checking policyÂ

They both checked the password policy ('test' was too short).

I am still confused about what this 'extension' does. Is that just about giving more details in the error output?

This is in openLDAP 2.4.39 and documented in the man ldapsearch page. ÂThe option is used in the ppolicy test code (test022-ppolicy).

Thanks,

Thierry

On Thu, May 1, 2014 at 3:43 AM, Michael StrÃder <michael@stroeder.com> wrote:

Dieter KlÃnter wrote:
> Am Wed, 30 Apr 2014 14:56:41 -0600
> schrieb Thierry Thelliez <thierry.thelliez.tech@gmail.com>:
>>

>> Looking at the test source code of 2.4.39 for the ppolicy script, I
>> can see the ldapsearch is using a '-e ppolicy' option. Â The man page
>> for ldapsearch lists 'general extensions' under -e and -E options.
>> But I cannot figure out what these extensions are.
>>
>> What is '-e ppolicy' ? and when do you need it?
>
> man ldapsearch(5)
>
> -e = general extended operation
> -E = search extended operation
> passwordPolicy is a general extended operation

I have no man page like this for OpenLDAP. Which man page is this? It sounds
strange to say something about extended operations.

-e and -E are for specifying extended *controls* along with the LDAP (search)
request:

Excerpt from ldapsearch(1):

   Â-e [!]ext[=extparam]

   Â-E [!]ext[=extparam]

       Specify general extensions with -e and search extensions with
       -E. ÂÂ! indicates criticality.

Ciao, Michael.