Reject password if it contains tokens from an attribute of the LDAP entry

[eseyman]

I've been asked to implement the rejection of new passwords if they contain the user's first or last name (we currently reject for username). Would it be possible to extend ppm's checkRDN's functionality to include other attributes than the RDN?

[davidcoutadeur]

Hi @eseyman, the feature could be interresting, but it is much more complicated to achieve, because as a ppolicy submodule, ppm only get few informations from the user.

[davidcoutadeur]

The function signature in ppolicy in OpenLDAP 2.5 allows to read the whole entry:

int check_password (char *pPasswd, char **ppErrStr, Entry *pEntry, struct berval *pArg);

This feature could be really interesting.

It would be nice to set any attribute for the check.

[davidcoutadeur]

Done in fbebaf2