[phpldapadmin] [ phpldapadmin-Feature Requests-2009667 ] Dealing with password policy

Feature Requests item #2009667, was opened at 2008-07-03 18:02
Message generated for change (Comment added) made by chipitsine
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498549&aid=2009667&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: Future
Status: Open
Priority: 5
Private: No
Submitted By: Clement OUDOT (clement_oudot)
Assigned to: Nobody/Anonymous (nobody)
Summary: Dealing with password policy

Initial Comment:
Hello there,

I think PLA is great administrative tool.

I often use the slapo-policy in OpenLDAP and think it would be a good functionnality to be able to manage this policy in PLA.

But this functionnality rely on LDAP controls, and I think PHP-LDAP can't manage it, is it true ?

If I'm false (I hope so), it can be interesting to have a lock/unlock button when viewing a user entry, and other administrative action like reseting the password history, and so on...

Have some of you already work on this?

Clement.

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-06 14:48

Message:
> the control OID of password policy is 1.3.6.1.4.1.42.2.27.8.5.1 (as
> written in the draft), and this OID can appear in the RootDSE. But if I

any LDAP server shows that attribute ?

> remember well, OpenLDAP does not publish this OID in the RootDSE
because
> it's a draft and not a RFC. So maybe we have to force the use of ppolicy
in
> PLA config.

there's still an opportunity to catch it via its behaviour.
if it behaves like ppolicy, so we think it's ppolicy ))

> Then, what can do PLA with ppolicy? I see 3 things:
> - Use ppolicy when doing authentication of PLA users (for example
display
> "account locked" if the user logs in and the authentication failed
because
> the account is locked) - Use of ppolicy control needed

that's good idea.
it even doesn't require PLA to know about ppolicy.
I'll try to code it soon

> - Use ppolicy when doing a password change (for example display
"password
> too short" if the submitted password is not long enough) - Use of
ppolicy
> control needed

it's questionable in turn.

for instance, if I login as "Manager", why should I care about password
policy ?
as regular user - yes, I should ))

if we can handle Manager separately, I see no problem with this as well.
You change your password, PLA catches an error and reports it.
like "ppolicy says password is not good enough because..."

> - View and edit entries operationnal attributes linked to ppolicy, as
the
> password history, the grace time, etc. - Use of ppolicy control not
needed
> - View and edit ppolicy configuration (OpenLDAP only) by modifiying the
> LDAP entries with objectClass=pwdPolicy - Use of ppolicy control not
needed


it is very similar to what is done via templates.
ppolicy uses certain objectClass, so editing is not that different from
any other editing ?


----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-01-06 14:00

Message:
Hello,

the control OID of password policy is 1.3.6.1.4.1.42.2.27.8.5.1 (as
written in the draft), and this OID can appear in the RootDSE. But if I
remember well, OpenLDAP does not publish this OID in the RootDSE because
it's a draft and not a RFC. So maybe we have to force the use of ppolicy in
PLA config.

Then, what can do PLA with ppolicy? I see 3 things:
- Use ppolicy when doing authentication of PLA users (for example display
"account locked" if the user logs in and the authentication failed because
the account is locked) - Use of ppolicy control needed
- Use ppolicy when doing a password change (for example display "password
too short" if the submitted password is not long enough) - Use of ppolicy
control needed
- View and edit entries operationnal attributes linked to ppolicy, as the
password history, the grace time, etc. - Use of ppolicy control not needed
- View and edit ppolicy configuration (OpenLDAP only) by modifiying the
LDAP entries with objectClass=pwdPolicy - Use of ppolicy control not needed

Clément.


----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-06 00:43

Message:
hmm, according to http://www.openldap.org/foundation/oid-delegate.txt
there's no OID related to ppolicy

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-06 00:34

Message:
rootDSE contains some information on supported features and extensions

can You please do the following query on your LDAP server(s) ?

ldapsearch -b "" -s base +


another way to view that information --> phpLDAPadmin --> server info

in my case I see many things there, except ppolicy

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-05 20:31

Message:
hmm, I think search with (objectClass=pwdPolicy) is not very good idea.
I read that draft and didn't find a way how can one determine whether
directory implements policy or not.

any suggestion ?

btw, how do you see phpLDAPadmin role in that ? any design thing, picture
or something ?

----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-01-05 17:28

Message:
The RFC draft is here:
http://www.faqs.org/ftp/pub/internet-drafts/draft-behera-ldap-password-policy-09.txt

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-05 16:22

Message:
is ppolicy defined by some RFC ? so, that many LDAP servers support it in
the same way ?

----------------------------------------------------------------------

Comment By: Clement OUDOT (clement_oudot)
Date: 2009-01-05 13:32

Message:
Hello,

the goal is not to test if we are with OpenLDAP or not, but to test if the
ppolicy control is available. All directories providing this control can
manage password policy.

----------------------------------------------------------------------

Comment By: Ilia Chipitsine (chipitsine)
Date: 2009-01-04 12:54

Message:
how can you make sure you are dealing with OpenLDAP ?

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498549&aid=2009667&group_id=61828

------------------------------------------------------------------------------
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/