https://bugs.openldap.org/show_bug.cgi?id=9740
--- Comment #3 from Ondřej Kuzník <[email protected]> --- On Fri, Nov 05, 2021 at 01:09:06PM +0000, [email protected] wrote: >> What is your usecase where you'd need different modules in the same >> server? > > No particular use case. > > It's just that before ppm, LTB project maintained another module named > "check-password", and maybe it can help the transition to announce that > OpenLDAP support multiple modules at one time... But again there is no real > use > case. Then I would wait until a compelling use case comes up before we consider reverting that change. >>> 2/ it does not seem to work. (ie the extended module is not launched). See >>> below for my config and data. >> >> Just checking you are actually building with --enable-modules? > > Yes indeed. > > If it can help: > > ./configure [...] Yes, that's fine, checking your policy again: - pwdCheckQuality is 2, great, but the password you're setting is hashed already so it will just fail before considering whether the module should be used - you are not using pwdUseCheckModule - the module configured will not actually be used even if dealing with plaintext passwords At least section 4.2.6 of the Behera draft[0] implicitly suggests that password administrators should be exempt from quality checking by being able to "set or reset the password to a well-known value." Is that the reason it wasn't being used for you or are you still having issues regardless of the above? The manpage doesn't seem to document that the module is not used unless pwdCheckQuality is also enabled. I'll see about fixing that, thanks. > Thanks for the clarification. > Actually, I meant the documentation of slapo-ppolicy (man page) > it could be nice to explain: > - what is deprecated > - what is each attribute made for That's already documented here: https://git.openldap.org/openldap/openldap/-/blob/master/doc/man/man5/slapo-ppolicy.5#L645 Could you suggest any improvements to address whatever other confusion you think exists? Thanks, [0]. https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10#section-4.2.6 -- You are receiving this mail because: You are on the CC list for the issue.
