LDAP shadow attributes not deleted when ppolicy is used

This document (3286022) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 10 Support Pack 1

SUSE Linux Enterprise Real Time

Situation

This issue was discovered when updating a LDAP enabled SLES10 GA version to SLES10 SP1 where the users have shadow data inside LDAP. After the update to SP1 it is possible to use ppolicy in LDAP. When ppolicy is enabled via the YaST-LDAP Server Module, the shadow attributes are not deleted in the LDAP tree.

When the YaST User Management module is being used, in the plugin tab both plugins are enabled (ppolicy and shadow). When exiting the Usermangement the following error is being reported:

ERROR:"It is not possible to add this plugin when the plugin for Shadow Account attributes is in use."

Resolution

Please update the package yast2-ldap to version 2.13.24 via online update.

Please note as SP1 is no longer maintained as patch level, please consider to upgrade to the most current service pack level.

Additional Information

When trying to disable the shadow account plugin the following error appears:

ERROR: "objectclass violation attribute "shadowInactive" not allowed

When trying to disable the ppolicy plugin this error was recognized

ERROR: "This plugin cannot be removed"

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.