Le 03/01/2017 à 08:05, Ulrich Windl a écrit : >>>> Quanah Gibson-Mount <quanah@symas.com> schrieb am 03.01.2017 um 00:11 in > Nachricht <F365AC223D2A1E22A5345243@[192.168.1.30]>: >> (...) >> >> Note the bit about "all the operations, ..." >> >> If you think of a way to reword it that you feel is a better explanation, >> that could certainly be considered. :) > > I think a notice who is the modifier on ppolicy changes would be woth it; specifically if it's related to RootDN ;-) > I think I had already asked earlier about some notice on ACLs that ppolicy may or may not need to work. Well I certainly didn't understand the message as 'every operation will be done assuming the rootdn identity' indeed. I agree with Ulrich, maybe a small note in the manpage saying exactly that might help, just in case ? Here is a proposal patch on slapo-ppolicy.5 manpage to clarify that. Thanks in advance, -- Matthieu Cerda
From c6c03415e73fe762ee8f77d3e3cad97834913d00 Mon Sep 17 00:00:00 2001 From: Matthieu Cerda <matthieu.cerda@nbs-system.com> Date: Tue, 3 Jan 2017 14:45:37 +0100 Subject: [PATCH] Clarify slapo-ppolicy manpage about rootdn absence possible consequences --- doc/man/man5/slapo-ppolicy.5 | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/doc/man/man5/slapo-ppolicy.5 b/doc/man/man5/slapo-ppolicy.5 index 8306f9761..6d3edb9c4 100644 --- a/doc/man/man5/slapo-ppolicy.5 +++ b/doc/man/man5/slapo-ppolicy.5 @@ -28,7 +28,12 @@ Note that some of the policies do not take effect when the operation is performed with the .B rootdn identity; all the operations, when performed with any other identity, -may be subjected to constraints, like access control. +may be subjected to constraints, like access control. It means that +not defining a +.B rootdn +in your configuration is likely to lead to undesirable behavior (like +account locking using pwdLockout not working properly) unless you have +appropriate access control entries. .P Note that the IETF Password Policy proposal for LDAP makes sense when considering a single-valued password attribute, while -- 2.11.0
Attachment:
signature.asc
Description: OpenPGP digital signature