Well I can not reproduce your issue exactly, but I am on a newer version
of DS. Although this code hasn't really changed in a long time. Anyway
you have conflicting policies (sort of). You have some things set in
the global policy and different settings in the subtree/local policies.
The global policy sets "pwdUpateTime", and the local policies only set
passwordExpirationtime. So it's either one of the other depending where
the target user is that is modified.
You can try setting nsslapd-pwpolicy-inherit-global to "on". That is
supposed to merge the global and local policies, but I would prefer if
you added passwordtrackupdatetime to all the local policies. That's
one thing. The other is that it looks like you are hitting a bug.
Directory Manager is applying the local policy, while your other user is
only processing the global policy (which is wrong). This is why the
behavior is different, but I can not explain why it's not consistent
between the two binding accounts (unless you modified the audit log
output you sent me). Now you are on a older version of
389-ds-base-1.4.3, so if it's a bug its been fixed in newer versions.
So trying updating your polices as I mentioned above and see if it
helps. Is there a newer version of 389-ds-base you can upgrade to (at
least to test this)?
Mark
On 3/16/22 3:20 PM, Mike Wohlgemuth wrote:
Here is the dsconf output:
# dsconf slapd-neuTestMain pwpolicy get
Global Password Policy: cn=config
------------------------------------
nsslapd-pwpolicy-local: on
passwordstoragescheme: PBKDF2_SHA256
passwordchange: on
passwordmustchange: off
passwordhistory: off
passwordinhistory: 6
passwordadmindn: cn=password_admins,ou=groups,dc=neu,dc=edu
passwordtrackupdatetime: on
passwordwarning: 86400
passwordisglobalpolicy: off
passwordexp: off
passwordmaxage: 8640000
passwordminage: 0
passwordgracelimit: 0
passwordsendexpiringtime: off
passwordlockout: off
passwordunlock: on
passwordlockoutduration: 3600
passwordmaxfailure: 3
passwordresetfailurecount: 600
passwordchecksyntax: off
passwordminlength: 8
passwordmindigits: 0
passwordminalphas: 0
passwordminuppers: 0
passwordminlowers: 0
passwordminspecials: 0
passwordmin8bit: 0
passwordmaxrepeats: 0
passwordpalindrome: off
passwordmaxsequence: 0
passwordmaxseqsets: 0
passwordmaxclasschars: 0
passwordmincategories: 3
passwordmintokenlength: 3
passwordbadwords:
passworduserattributes:
passworddictcheck: off
passworddictpath:
nsslapd-allow-hashed-passwords: off
nsslapd-pwpolicy-inherit-global: off
# dsconf slapd-neuTestMain localpwp list
ou=facultyandstaff,dc=neu,dc=edu (subtree policy)
ou=people,dc=neu,dc=edu (subtree policy)
ou=student,dc=neu,dc=edu (subtree policy)
# dsconf slapd-neuTestMain localpwp get ou=facultyandstaff,dc=neu,dc=edu
Local Subtree Policy Policy for "ou=facultyandstaff,dc=neu,dc=edu": cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3Dfacultyandstaff\2Cdc\3Dneu\2Cdc\3Dedu,cn=nsPwPolicyContainer,ou=facultyandstaff,dc=neu,dc=edu
------------------------------------
passwordexp: on
passwordmaxage: 31536000
# dsconf slapd-neuTestMain localpwp get ou=people,dc=neu,dc=edu
Local Subtree Policy Policy for "ou=people,dc=neu,dc=edu": cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3Dpeople\2Cdc\3Dneu\2Cdc\3Dedu,cn=nsPwPolicyContainer,ou=people,dc=neu,dc=edu
------------------------------------
passwordexp: on
passwordmaxage: 31536000
[root@nb9545 ldap]# dsconf slapd-neuTestMain localpwp get ou=student,dc=neu,dc=edu
Local Subtree Policy Policy for "ou=student,dc=neu,dc=edu": cn=cn\3DnsPwPolicyEntry_subtree\2Cou\3Dstudent\2Cdc\3Dneu\2Cdc\3Dedu,cn=nsPwPolicyContainer,ou=student,dc=neu,dc=edu
------------------------------------
passwordexp: on
passwordmaxage: 31536000
_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--
Directory Server Development Team
_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
