How to modify the default LDAP policy

[quentinfougeron]

Hi,

We want to customize the pwpolicies of our Apigee environment and in particular the one set up for default users.

I followed this from the documentation:

https://docs.apigee.com/private-cloud/v4.18.05/managing-default-ldap-password-policy-api-management

but it doesn't work. there is no effect on the policy when I create a new user.

I have also tried applying

https://community.apigee.com/articles/39204/how-do-i-setup-a-password-policy-for-a-single-orga-1.htm...

directly to ou = users, ou = global, dc = apigee, dc = com instead of a specific user but that doesn't change anything either

Does someone have an idea ?

[dchiesa1]

there is no effect on the policy when I create a new user.

I think you're saying, There's no effect on the newly-created user when this policy is in place. In other words, the newly created user does not get the pw expiration policy that you expect.

That sounds frustrating.

The problem you're describing is an LDAP problem. Can you give some additional information?

What is the pwdMaxAge you try to set? What is the value attached to the user when you create it? Can you show the output of ldapsearch command on the particular newly-created user to show the password expiration? Something like this

ldapsearch -b
'cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu'

passwordMaxAge passwordWarning passwordMinAge passwordExp passwordGraceLimit

Can you show the ldapmodify command you used to set the pwdMaxAge?

Can you show the pwdMaxAge in your LDAP , following the suggestion in the answer described here?

[quentinfougeron]

I created this pwpolicy that I want to apply to all new users added to the Env :

# pwGlobalUsers, pwpolicies, apigee.com
dn: cn=pwGlobalUsers,ou=pwpolicies,dc=apigee,dc=com
objectClass: person
objectClass: pwdPolicy
objectClass: top
objectClass: pwdPolicyChecker
cn: pwGlobalUsers
pwdAttribute: userPassword
sn: dummy value
pwdExpireWarning: 604800
pwdInHistory: 3
pwdLockout: TRUE
pwdLockoutDuration: 300
pwdFailureCountInterval: 300
pwdMaxAge: 0
pwdMaxFailure: 3
pwdMinLength: 11
pwdCheckQuality: 2
pwdCheckModule: check_password.so

So I created this file modifyuserspolicy

dn: ou=users,ou=global,dc=apigee,dc=com
changetype: modify
add: pwdPolicySubentry
pwdPolicySubentry: cn=pwGlobalUsers,ou=pwpolicies,dc=apigee,dc=com

and ran ldapmodify

ldapmodify -x -w "$ldappassword" -D "cn=manager,dc=apigee,dc=com" -H ldap://localhost:10389 -f modifyuserspolicy

now I see the pwdPolicySubentry

# users, global, apigee.com
dn: ou=users,ou=global,dc=apigee,dc=com
pwdPolicySubentry: cn=pwGlobalUsers,ou=pwpolicies,dc=apigee,dc=com

But When I create a the user password created from the dashboard I can enter a password with less than 11 chars

What am I doing wrong ?