On 11/16/2016 07:06 AM, Alberto Viana wrote:
All you should need to do is setup a subtree policy on those OU's, and those should override the global policy.Hi,
Anyone? I really need some help on this.
There was bug, that I can not seem to find anymore, where this was not working: Subtree policy was not overriding the global policy. It was fixed, but I don't know if the version of 389 that you have has that fix or not. Make sure you are on the latest version of 389 that your platform supports.
If this does not work please file a ticket with the exact steps to reproduce the problem:
On Fri, Nov 4, 2016 at 1:01 PM, Alberto Viana <firstname.lastname@example.org> wrote:
Just to explain better what I need:
Enforce a global password policy with password expiration but disable for some specifics OUs (just disable the password expiration).
On Fri, Nov 4, 2016 at 12:54 PM, Alberto Viana <email@example.com> wrote:
What I Need:
Enforce a global password policy but disable for some specifics OUs.
mentation/en-US/Red_Hat_Direct ory_Server/10/html-single/Admi nistration_Guide/index.html# User_Account_Management-Managi ng_the_Password_Policy
Everything was working fine but I realized for that specific OU that I created a local policy started to storage user password as plaintext:
I created the local policy using the script ns-newpwpolicy.pl as below:
y.pl-v -D "cn=Directory Manager" -w my_manager_pass -S OU=testing,dc=homolog,dc=rnp
Here's my config:
nsslapd-pwpolicy-local: on (under cn=config)
Double checked using 389 console that under this OU, "Fine-grained subtree policy enabled" is set on.
ldapsearch -b 'cn="cn=nsPwTemplateEntry,OU=t
esting,dc=homolog,dc=rnp",cn=n sPwPolicyContainer,OU=testing, dc=homolog,dc=rnp' -D "cn=Directory Manager" -x -W '(objectclass=ldapsubentry)'# extended LDIF## LDAPv3# base <cn="cn=nsPwTemplateEntry,OU=t esting,dc=homolog,dc=rnp",cn=n sPwPolicyContainer,OU=testing, dc=homolog,dc=rnp> with scope subtree# filter: (objectclass=ldapsubentry)# requesting: ALL#
testing\2Cdc\3Dhomolog\2Cdc\3D rnp, nsPwPolicyContainer, testing, homolog.rnpdn: cn=cn\3DnsPwTemplateEntry\2COU \3Dtesting\2Cdc\3Dhomolog\2Cdc \3Drnp,cn=nsPwPolicyContainer,OU=testing ,dc=homolog,dc=rnppasswordStorageScheme: SSHApasswordChange: offpasswordMaxAge: 8640000passwordExp: offobjectClass: topobjectClass: extensibleObjectobjectClass: costemplateobjectClass: ldapsubentrycosPriority: 1cn: cn=nsPwTemplateEntry,OU=testin g,dc=homolog,dc=rnp
A user entry on this OU:
olog,dc=rnpuserPassword:: MXEydzNlNHI=ntUserLastLogon: 131219776403276312objectClass: topobjectClass: personobjectClass: organizationalpersonobjectClass: inetOrgPerson
Am I missing something?
_________________ 389-users mailing list -- firstname.lastname@example.org. orgTo unsubscribe send an email to 389-users-leave@lists. fedoraproject.org
389-users mailing list -- email@example.com.
To unsubscribe send an email to 389-users-leave@lists.