Adding password policies to historical instance.

Question

Hi,
Newbie here - just inherited management of our LDAP systems so please be patient.
We've got a directory instance that has been multiply upgraded. Originally it was based on OpenLDAP  then SUN DS5, through DS6 and now DS7.
We have a requirement to add password policies to a subgroup within the repository which I believe I have done but it doesn't seem to work.
So far, taken server from DS5 compat mode to DS6-mode, created password policy via admin interface and applied it to relevant group. Features of the policy are password lifetime, 3 incorrect login attempts, password dictionary etc etc.
Problem: test user tries to log in. After 3 failures there is no lockout. User can fail login any number of times then a correct attempt will work.
The custom policy is set to override the global policy for the affected group.
The question is why is the policy not being followed?
I'm concerned there may be some historical feature of the schema which is preventing the policy from functioning. If this is the case ( and how would I find out if this is so) what might be done about it?
Regards

Answer 1

Hello,
sunPwdPolicy objectclass contains Sun specific extension and derive from  the standard password policy objectclass defined in passwordPolicy,
so in general, password policy entries contain both objectclasses as long as you start using Sun extensions
( 1.3.6.1.4.1.42.2.27.9.2.119
NAME 'sunPwdPolicy'
DESC 'Sun Directory Server Password Policy objectclass'
SUP pwdPolicy
AUXILIARY
MUST ( cn )
MAY ( description $
  passwordRootdnMayBypassModsChecks $
  passwordStorageScheme $
  passwordExpireWithoutWarning $
  pwdIsLockoutPrioritized $
  pwdKeepLastAuthTime )
X-DS-USE 'internal'
X-ORIGIN 'Sun Directory Server' )
( 1.3.6.1.4.1.42.2.27.8.2.1
NAME 'pwdPolicy'
DESC 'Password Policy objectclass'
SUP top
AUXILIARY
MUST ( pwdAttribute )
MAY ( pwdMinAge $
  pwdMaxAge $
  pwdInHistory $
  pwdCheckQuality $
  pwdMinLength $
  pwdExpireWarning $
  pwdGraceAuthNLimit $
  pwdLockout $
  pwdLockoutDuration $
  pwdMaxFailure $
  pwdFailureCountInterval $
  pwdMustChange $
  pwdAllowUserChange $
  pwdSafeModify)
X-DS-USE 'internal'
X-ORIGIN 'Password Policy for LDAP Directories Internet Draft' )
-Sylvain