1

So far, I discovered "pwdminlength" attribute in password policy doesn't work when OpenLDAP uses SHA or crypt options as password modification techniques. Though, it does work with clear-text. This is really bad, because as a system admin we cannot ask users to modify their passwords with clear-text option.

Does anyone have other alternatives for this password policy to work correctly even with the "pwdminlength" attribute?

Improve this question

1 Answer 1

Reset to default
1

The pwdMinLength attribute can be enforced but provided the user uses the LDAPv3 Password Modify (RFC 3062) extended operation to set their password, i.e. what the tool ldappasswd does. This way the server will see the clear password prior to storing it as an encrypted value using whatever hashing scheme is chosen.

By also setting the pwdCheckQuality attribute to 2 in the policy object the server will reject any value it cannot verify thereby stopping users from updating the attribute to a hashed value.

Improve this answer
1
  • understood. thanks very much having look at this.
    – krs4keshara
    May 9, 2017 at 1:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .