IDS 5.0 SP2 + Solaris 8 password problem

Question

Iplanet version : iDS 5.0 SP2 + Solaris 8
Password:
user must change password after reset : yes
user may change password : yes
allow changes in 0 days
keep password history : yes
remeber 6 password
Password expires after 90 days
send warning 7 days before password expires
check password syntax : yes
password min length : 6
Account lockout:
Account maybe lockout : yes
Lockout account after 3 login failures
reset failure count after 525600 minutes
Lockout forever : yes
We discovered that when the user password is expired due to the field 'passwordexpirationtime' is past, there are two types of password expiration within iplanet ldap. One type of expiration will allow user to change the password by themselves, however, the other type did not
We discovered that when we put a 'Z' on the field passwordexpirationtime, it will show the first type of password expiration that user can change their password. When we remove the 'Z' from the field passwordexpirationtime. it will not allow the user to change the password by themselves, we provide a screen dump at the end.
Moreover, the problem may be triggered by other event instead of adding a 'Z' on the passwordexpirationtime field
Here is the screen dump for you to investigate, you can see that the output with 'DSA is unwilling to perform' is the type where user can change their password, while the output with 'Invalid credentials' is the type where user CANNOT change their password.
Case 1
======
%ldapsearch -p 3389 -b o=orange,c=us uid=john passwordexpirationtimeuid=john,o=jpmorgan,c=us
passwordexpirationtime=19900101000000Z
%ldapsearch -v -p 3389 -D uid=john,o=orange,c=us -w abc123 -b o=jpmorgan,c=us uid=john
ldap_init(localhost, 3389)
filter pattern: uid=john
returning: ALL
filter is: (uid=john)
ldap_search: DSA is unwilling to perform
0 matches
Case 2
======
%ldapsearch -p 3389 -b o=orange,c=us uid=john passwordexpirationtimeuid=john,o=jpmorgan,c=us
passwordexpirationtime=19900101000000
%ldapsearch -v -p 3389 -D uid=john,o=orange,c=us -w abc123 -b o=jpmorgan,c=us uid=john
ldap_init(localhost, 3389)
ldap_simple_bind: Invalid credentials
ldap_simple_bind: additional info: password expired!
I know there's nothing to do with 'zuru' suffix, ldap schema supports both of attribute
values format. But this happen in my LDAP. Any hints?
Question:
- Under what condition the LDAP will complain "DSA is unwilling to perform" or
"Invalid credentials"
- Any hints to resolve the problem

Answer 1

If something had changed recently, drill into that.
Do a hardware RAM test to confirm HW level soundness.
You may capture the core dump or similar information and send it to Microsoft for analysis.
They may ask you to do the usual thing: apply W2KSP4 and/or OS and security patches.
You also have the option of migrating IDS5.0/Windows to IDS5.2Patch3 (also as Sun Java System DirSvr 5.2) running on Solaris10 x86.
Gary