Re: [SSSD] sssd on RHEL5 w/ OpenLDAP backend issues

[Stephen Gallagher]

On Thu, 2012-01-26 at 14:41 -0800, Eric wrote:
>  Hello,
>  
>  I have searched for an appropriate list to post this question and
>  figured this was the best I could find and apologize in advance for the
>  wasted bandwidth and chatter. Just point me to the right direction.
>   
Nope, you've come to the right place. We don't have a separate users
list.

>  
>  I am trying to implement a password policy (i.e. password expiration
>  (max age), password history, etc) on RHEL 5. I am kind of at a loss. Is
>  there any plans to add functionality into sssd for RHEL5 that will give
>  this type of functionality? See below for details on what I have tried.
>   
SSSD should already support this (to a certain extent).

>  
>  I was hoping to use sssd with the backend of OpenLDAP 2.4.26 since this
>  is used extensively at my organization already.
>  
>  I tried using the ppolicy overlay from OpenLDAP, but that does not
>  provide any feedback to the user about pending password expiration via
>  sssd.
>   
Yes it does, though by default we don't report it unless the expiration
is fewer than seven days away. This is configurable with
pam_pwd_expiration_warning = N
Where N is the number of days in advance to warn.

>  So at the time and date of expiration, the user is unable to login
>  without any prior warning and is unable to login.
>  
>  Instead I see the following in /var/log/sssd/sssd_LDAP.log 
>  
>       [sssd[be[LDAP]]] [sdap_control_create] (3): Server does not
>  support the requested control [1.3.6.1.4.1.42.2.27.8.5.1].   The above
>  apparently is the ldap contral which gives the warning about password
>  expiration which sssd does not see.
>   
You're hitting https://bugzilla.redhat.com/show_bug.cgi?id=748856 which
is fixed in RHEL 5.8 (and is available in the RHEL 5.8 beta right now).

We already support this control fully, but we had a bug where we weren't
properly detecting that the server supported it.


>  Any plans to update sssd for RHEL5 to support "Controls used for
> Password Policy" found in
>  http://tools.ietf.org/html/draft-behera-ldap-password-policy-07. 
>  
>  I can provide more information upon request.
>  
>  
>  Any help with this would be greatly appreciated.