search for: pwdfailuretim

I'm trying to setup OpenLDAP on CentOS7, in a provider/consumer relationship. In general, provider/consumer is working quite well, except when it comes to password policy. Specifically, I want PwdFailureTime to be written to the provider from one of the front end consumers when appropriate. I'm lead to believe this requires: a) ppolicy_foward_updates TRUE (done) b) an appropriate syncrepl configuration for the consumer (I believe done) c) updateref $LDAP-provider-URI (done) d) an appropriate...

...k across the board...such that if a user fails 5 times on a Windows machine, they will be locked out on the Linux systems as well....and vice versa. Here's what I'm seeing: On windows, failing authentication updates the "Bad Password Count" in Samba, additionally it adds a "pwdfailuretime" to the LDAP server. This is good, and is what we would like to see. Fail 2, similar Fail 3, similar Fail 4, similar On Fail 5, what seems to be happening is that the LDAP server puts in its 5th pwdfailuretime item, thereby locking the account, and essentially preventing Windows/samba from...