2

I am working on enabling ApacheDS (version 2.0.0-M16) to enforce strong passwords - combination of alphanumeric and special characters. I have created my own instance for testing.

As a start, I switched the password quality check to STRICT (2) and changed the minimum length value to 7:

    dn: ads-pwdId=default,ou=passwordPolicies,ads-interceptorId=authenticationInterceptor,ou=interceptors,ads-directoryServiceId=default,ou=config
    ads-pwdMinLength: 7
    ads-pwdinhistory: 5
    ads-pwdid: default
    ads-pwdCheckQuality: 2
    ads-pwdlockout: TRUE
    ads-pwdlockoutduration: 0
    ads-pwdvalidator: org.apache.directory.server.core.api.authn.ppolicy.DefaultPasswordValidator
    ads-pwdmaxfailure: 5
    ads-pwdfailurecountinterval: 30
    ads-pwdattribute: userPassword
    entryParentId: 4f761b8b-c70c-43a2-bb6f-d26e8c297f84
    ads-enabled: TRUE
    objectclass: top
    objectclass: ads-base
    objectclass: ads-passwordPolicy
    entryuuid: c83189f9-8ee4-4aec-9180-6e3f6d8297c6
    ads-pwdgraceauthnlimit: 5
    modifyTimestamp: 20140508182112.262Z
    entryCSN: 20140508182112.263000Z#000000#001#000000
    ads-pwdexpirewarning: 600
    modifiersName: 0.9.2342.19200300.100.1.1=admin,2.5.4.11=system

I then tried to import an ldif entry through the Apache Directory Studio with an obviously invalid password but the validation does not kick in. User is created successfully:

    dn: cn=SherlockHolmes,ou=people,o=sevenSeas
    objectclass: person
    objectclass: organizationalPerson
    objectclass: inetOrgPerson
    objectclass: top
    cn: Sherlock Holmes
    description: Sherlock Holmes
    givenname: Sherlock
    sn: Holmes
    uid: SHolmes
    mail: SHolmes@gmail.com
    userpassword: watson

What am I doing wrong?

Also, is there any way I can configure the complexity of the password in the form of a regex? I don't see this in the conf file.

Heretic Monkey
  • 11,687
  • 7
  • 53
  • 122
user3617720
  • 21
  • 2

1 Answers1

0

Did you restart the server after updating the password policy?. Server must be restarted to enforce the updated policy.

kayyagari
  • 1,882
  • 13
  • 10
  • Yes I did restart the server. I tried using different approaches to create the user- LDIF import, via Directory Studio but always, the user with weak password gets created successfully. – user3617720 May 13 '14 at 08:54
  • 2
    Your configuration is correct. Make sure that you are not adding this entry as an administrator, password policy is not enforced when an administrator adds or modifies a password – kayyagari May 13 '14 at 14:50