Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-09 Thread Volker Lendecke
On Tue, Apr 08, 2008 at 10:10:18AM -0400, Ryan Steele wrote: I'm using ldapsam:ldap://server as my passdb backend, so I'm not sure why it's showing the user this message instead. I see I can edit the values that Samba is showing the user with pdbedit, but I shouldn't need to edit that - my

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-09 Thread Ryan Steele
Volker Lendecke wrote: On Tue, Apr 08, 2008 at 10:10:18AM -0400, Ryan Steele wrote: I'm using ldapsam:ldap://server as my passdb backend, so I'm not sure why it's showing the user this message instead. I see I can edit the values that Samba is showing the user with pdbedit, but I

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-09 Thread Adam Tauno Williams
I'm using ldapsam:ldap://server as my passdb backend, so I'm not sure why it's showing the user this message instead. I see I can edit the values that Samba is showing the user with pdbedit, but I shouldn't need to edit that - my password policy is defined in LDAP, and those are the

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-09 Thread Volker Lendecke
On Wed, Apr 09, 2008 at 11:40:33AM -0400, Adam Tauno Williams wrote: How are these policies exactly defined in LDAP? Are they visible for LDAP clients? It's an explicit entry in LDAP: ppolicy support in Samba would be awesome. Would make PCI/DSS (and other regulatory compliance)

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-09 Thread simo
On Wed, 2008-04-09 at 17:54 +0200, Volker Lendecke wrote: On Wed, Apr 09, 2008 at 11:40:33AM -0400, Adam Tauno Williams wrote: How are these policies exactly defined in LDAP? Are they visible for LDAP clients? It's an explicit entry in LDAP: ppolicy support in Samba would be

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-09 Thread Adam Tauno Williams
On Wed, 2008-04-09 at 11:57 -0400, simo wrote: On Wed, 2008-04-09 at 17:54 +0200, Volker Lendecke wrote: On Wed, Apr 09, 2008 at 11:40:33AM -0400, Adam Tauno Williams wrote: How are these policies exactly defined in LDAP? Are they visible for LDAP clients? It's an explicit entry

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-09 Thread simo
On Wed, 2008-04-09 at 15:11 -0400, Adam Tauno Williams wrote: On Wed, 2008-04-09 at 11:57 -0400, simo wrote: On Wed, 2008-04-09 at 17:54 +0200, Volker Lendecke wrote: On Wed, Apr 09, 2008 at 11:40:33AM -0400, Adam Tauno Williams wrote: How are these policies exactly defined in LDAP?

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-08 Thread Ryan Steele
Volker Lendecke wrote: On Mon, Apr 07, 2008 at 03:19:00PM -0400, Ryan Steele wrote: It's not defined in my Samba source, but I guess that was the wrong place to look. On my system, /usr/include/ldap.h does in fact have that defined. However, Samba still returns NT_STATUS_UNSUCCESSFUL,

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-08 Thread Ryan Steele
Volker Lendecke wrote: On Mon, Apr 07, 2008 at 03:19:00PM -0400, Ryan Steele wrote: It's not defined in my Samba source, but I guess that was the wrong place to look. On my system, /usr/include/ldap.h does in fact have that defined. However, Samba still returns NT_STATUS_UNSUCCESSFUL,

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-07 Thread Ryan Steele
Volker Lendecke wrote: On Fri, Apr 04, 2008 at 04:47:56PM -0400, John Drescher wrote: I think the bug/problem is that this message is being displayed instead of Password could not be changed for user tester: Constraint violation and does not pass required number of strength checks (1

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-07 Thread Volker Lendecke
On Mon, Apr 07, 2008 at 02:03:32PM -0400, Ryan Steele wrote: #if defined(LDAP_CONSTRAINT_VIOLATION) if (rc == LDAP_CONSTRAINT_VIOLATION) return NT_STATUS_PASSWORD_RESTRICTION; #endif

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-07 Thread Ryan Steele
Volker Lendecke wrote: On Mon, Apr 07, 2008 at 02:03:32PM -0400, Ryan Steele wrote: #if defined(LDAP_CONSTRAINT_VIOLATION) if (rc == LDAP_CONSTRAINT_VIOLATION) return NT_STATUS_PASSWORD_RESTRICTION;

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-07 Thread Volker Lendecke
On Mon, Apr 07, 2008 at 03:19:00PM -0400, Ryan Steele wrote: It's not defined in my Samba source, but I guess that was the wrong place to look. On my system, /usr/include/ldap.h does in fact have that defined. However, Samba still returns NT_STATUS_UNSUCCESSFUL, and Windows still reports

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-05 Thread Volker Lendecke
On Fri, Apr 04, 2008 at 04:47:56PM -0400, John Drescher wrote: I think the bug/problem is that this message is being displayed instead of Password could not be changed for user tester: Constraint violation and does not pass required number of strength checks (1 of 3). Current 3.2 has the

Re: [Samba] Samba 3.0.24 handling LDAP responses incorrectly

2008-04-04 Thread John Drescher
On Fri, Apr 4, 2008 at 4:41 PM, Ryan Steele [EMAIL PROTECTED] wrote: Hey list, Recently I've gotten my Samba PDC to successfully use an OpenLDAP backend, while using the smbk5pwd and ppolicy overlays for OpenLDAP. However, Samba appears to incorrectly handle responses from LDAP's ppolicy