problems to define password policy to subtree ni dt

hi....

i dont know how i can't make work password policy for an subentry in dt.

these are my dt test:

[prueba.uy]

|- cn=depto

|- cn=users

|- user1

|- user2

and define a pwd policy under cn=depto,cn=prueba,cn=uy where the mini lenght to passwords is 8, and check sintaxis (for manager when hi set pwd too).

i try to set the pwd policy to users subtree by two ways:

1) in gui ds i setting the pwd policy for these subtree

2) using cos mechanins (using pointer definition) i add the following cos:

template cos:

dn: cn=pwdPolTemplateCos,cn=users,cn=depto,dc=prueba,dc=uy

objectclass: top

objectclass: LDAPsubentry

objectclass: extensibleobject

objectclass: cosTemplate

cosPriority: 1

passwordPolicySubentry: cn=pwdPolicy,cn=depto,dc=prueba,dc=uy

definition cos:

dn: cn=pwdPolDefinitionCos,cn=users,cn=depto,dc=prueba,dc=uy

objectclass: top

objectclass: LDAPsubentry

objectclass: cosSuperDefinition

objectclass: cosPointerDefinition

cosTemplateDn: cn=pwdPolDefinitionCos,cn=users,cn=depto,dc=prueba=uy

cosAttribute: passwordPolicySubentry override

but... i can set pwd's for my users with length 2..

i try restart server thinking for problem is cache with not results, testing with ldapsearch for pwd attributes by nothing....

and i could't find where i wrong... :(

any suggests?

Thanks!!!!

[1492 byte] By [maximatta] at [2007-11-27 10:23:39]
# 1

What user are you using to reset the passwords? Are you using Directory Manager? Have you set: Allow Directory Manager to bypass Password Policy?

What happens if you use an account other than Directory Manager?

Eric

erk14485a at 2007-7-28 17:23:09 > top of Java-index,Web & Directory Servers,Directory Servers...
# 2

>>>>>>>Have you set: Allow Directory Manager to bypass Password Policy?

how do you do this...BY making an ACI?

anandkaturia at 2007-7-28 17:23:09 > top of Java-index,Web & Directory Servers,Directory Servers...
# 3

Before trying to diagnose the password policy operation, confirm your CoS is configured correctly:

ldapsearch -D 'cn=Directory Manager' -1 -T -s base -b <target_user_dn> '(|(objectclass=ldapsubentry)(objectclass=*))' passwordPolicySubentry

The result should be the password policy subentry DN you defined in your CoS template.

Then, confirm the entry reported by the above is there:

ldapsearch -D 'cn=Directory Manager' -1 -T -s base -b <passwordPolicySubentry_value_from_above> '(|(objectclass=ldapsubentry)(objectclass=*))'

solaris1a at 2007-7-28 17:23:09 > top of Java-index,Web & Directory Servers,Directory Servers...
# 4

hi...

i can make work!!!

i have defined an ACI in users and contains an error, i put a "," and not a "=" in dn specification.

and now i go to set to Allow Directory Manager to bypass Password Policy.

thanks!!!!

maximatta at 2007-7-28 17:23:09 > top of Java-index,Web & Directory Servers,Directory Servers...