1
我試圖用的OpenLDAP，建立用戶帳戶鎖定的情況，但我看到下面的錯誤運行ldapmodify命令時：打開LDAP - 一changeType：屬性類型未定義
C:\OpenLDAP\ClientTools>ldapmodify.exe -a -x -D dc=maxcrc,dc=com -w secret -f c:\OpenLDAP\ldifdata\usersNames.ldif
ldap_connect_to_host: TCP localhost:389
ldap_new_socket: 628
ldap_prepare_socket: 628
ldap_connect_to_host: Trying ::1 389
ldap_pvt_connect: fd: 628 tm: -1 async: 0
attempting to connect:
connect success
adding new entry "uid=LDAPadmin5,ou=users,dc=maxcrc,dc=com"
ldap_add: Undefined attribute type (17)
additional info: changetype: attribute type undefined
下面是政策，slapd.conf中的內容和usersNames.ldif文件
Policies3.ldif：
dn: ou=Policies3,dc=maxcrc,dc=com
ou: Policies1
objectClass: organizationalUnit
dn: cn=passwordDefault,ou=Policies3,dc=maxcrc,dc=com
objectClass: pwdPolicy
objectClass: person
objectClass: top
cn: passwordDefault
sn: passwordDefault
pwdAttribute: userPassword
pwdCheckQuality: 0
pwdMinAge: 0
pwdMaxAge: 0
pwdMinLength: 8
pwdInHistory: 5
pwdMaxFailure: 3
pwdFailureCountInterval: 0
pwdLockout: TRUE
pwdLockoutDuration: 0
pwdAllowUserChange: TRUE
pwdExpireWarning: 0
pwdGraceAuthNLimit: 0
pwdMustChange: FALSE
pwdSafeModify: FALSE
dn: cn=passwordDefault,ou=Policies3,dc=maxcrc,dc=com
objectClass: pwdPolicy
objectClass: person
objectClass: top
cn: default
pwdMaxAge: 2592000
pwdExpireWarning: 3600
#pwdInHistory: 0
#pwdCheckQuality: 0
pwdMaxFailure: 5
pwdLockout: TRUE
#pwdLockoutDuration: 0
#pwdGraceAuthNLimit: 0
#pwdFailureCountInterval: 0
pwdMustChange: TRUE
pwdMinLength: 6
#pwdAllowUserChange: TRUE
pwdSafeModify: FALSE
的slapd.conf項有關這一政策：
include ./schema/ppolicy.schema
moduleload ppolicy.la
#-- Load overlay
overlay ppolicy
ppolicy_default "cn=passwordDefault,ou=Policies3,dc=maxcrc,dc=com"
usersNames.ldif：
dn:uid=LDAPadmin5,ou=users,dc=maxcrc,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
cn: LDAPadmin5
ou: LDAPadmin5
sn: LDAPadmin5
uid: LDAPadmin5
userPassword:LDAPadmin5
changetype: modify
add: pwdPolicySubentry
pwdPolicySubentry: "cn=passwordDefault,ou=Policies2,dc=maxcrc,dc=com"
memberOf:cn=group7,ou=groups,dc=maxcrc,dc=com
memberOf:cn=group8,ou=groups,dc=maxcrc,dc=com
的Policies3項是在OpenLDAP的資源管理器中，但不能查看其下的屬性 「pwdLockout」。而LDAPadmin5用戶已經存在於系統中。