[Fedora-directory-users] Account Expiration Warning

[Jim Summers]

Jamie McKnight wrote:
>>>in /etc/ldap.conf, and that your pam stack is set up for pam_ldap
>>>authentication.  Also, if you are using a proxy agent, the proxy agent
>>>must not be able to see the userPassword attribute, or you will end up
>>>authenticating via pam_unix, and not pam_ldap.  
>>
>>This could be the problem.  I am using a proxy and not sure how to test 
>>what you are saying.  If I do an ldasearch such as:
>>
>>ldapsearch -x -ZZ '(uid=tulsa)'
>>
>>then that should bind via the entries in ldap.conf hence use the 
>>config'd proxy, correct?  Then if that search shows a userPassword then 
>>that would confirm pam_unix usage?  Not sure how to stop it if it is 
>>using pam_unix?
>>
> 
> 
> That's correct, if you can do a ldapsearch and bind as the proxyagent
> and you see the userPassword attribute returned, then the directory
> server has an ACI that allows read for your proxy agent of the
> userPassword attribute.  You can just remove that ACI and it should at
> that point not return the userPassword field, and pam_ldap
> authentication would take place then.
> 
> For example:
> 
> ldapsearch -x -h ldapsrv -D "cn=proxyid,dc=blah" -W -b
> "ou=people,dc=blah" uid=tulsa
> 
> Where -D is the id listed as proxyagent in ldap.conf, and the password
> supplied is for that id.  If userPassword is returned then you know what
> is going on.
> 
> If this is not what is happening, check and make sure you don't have
> rootbinddn and /etc/ldap.secret set up.  If it is actually binding as
> your rootdn then that is what it could be as well.

Welp, I am stumped.  Running various ldapsearchs I got the results as 
they should be.  Binding as the proxy, no userPassword, binding as an 
admin then I get the userPassword.

I looked in /etc/ and there is not an ldap.secret file, so I guess I do 
not have the rootbinddn setup.

I was thinking of removing the shadowExpire attributes but I am afraid 
if I do that then cron may stop working.

Not sure at this point.

Thanks,
jim


> 
> 
> Jamie
> 
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users

-- 
Jim Summers
School of Computer Science-University of Oklahoma
-------------------------------------------------