Password Policy Question

[Geiman Gilbert-GGEIMAN1]

I am confused by two seemingly contradictory things about the way in which password policies are supported by pam_ldap.  The list of new things supported on the web page indicates IETF password policies are supported (the implication being FULLY supported).  However, the code appears to indicate that only Netscape Directory Server policies are supported.  Can someone please clarify the extent to which full IETF password policies are supported?  And does the pam_policy_lookup option completely control whether policies are used?

Thanks,
gil

---------------------------------------------------------
Gil Geiman
CND Softswitch Systems Engineering
Motorola, Inc.
ggeiman1@...

[Andreas Hasenack]

On Sunday 02 July 2006 01:05, Geiman Gilbert-GGEIMAN1 wrote:
> I am confused by two seemingly contradictory things about the way in
> which password policies are supported by pam_ldap.  The list of new
> things supported on the web page indicates IETF password policies are
> supported (the implication being FULLY supported).  However, the code
> appears to indicate that only Netscape Directory Server policies are
> supported.  Can someone please clarify the extent to which full IETF
> password policies are supported?  And does the pam_policy_lookup option
> completely control whether policies are used?

Version 182+ supports OpenLDAP 2.3.24+ password policy. I don't know if this
is the IETF password policy you are talking about, though.

[Howard Chu]

Andreas Hasenack wrote:

> On Sunday 02 July 2006 01:05, Geiman Gilbert-GGEIMAN1 wrote:
>> I am confused by two seemingly contradictory things about the way in
>> which password policies are supported by pam_ldap.  The list of new
>> things supported on the web page indicates IETF password policies are
>> supported (the implication being FULLY supported).  However, the code
>> appears to indicate that only Netscape Directory Server policies are
>> supported.  Can someone please clarify the extent to which full IETF
>> password policies are supported?  And does the pam_policy_lookup option
>> completely control whether policies are used?
>
> Version 182+ supports OpenLDAP 2.3.24+ password policy. I don't know if this
> is the IETF password policy you are talking about, though.
>

Yes, the version in OpenLDAP is the IETF draft spec. It's all spelled
out pretty explicitly in the slapo-ppolicy(5) manpage.

--
   -- Howard Chu
   Chief Architect, Symas Corp.  http://www.symas.com
   Director, Highland Sun        http://highlandsun.com/hyc
   OpenLDAP Core Team            http://www.openldap.org/project/