Quack,

I was annoyed by slapd warning me about "unrecognized control", and as
we do not use ppolicy I decided to set "pam_authc_ppolicy no". I
realized this setting breaks PAM authentication on my system.
nslcd/authc reports "Unknown error" when I try to authenticate.

 From what I can see in the source code this error only applies to
ppolicy processing ('compat/ldap_passwordpolicy_err2txt.c'). If I'm not
mistaken the authenticate() function in 'pynslcd/pam.py' should check
for 'cfg->pam_authc_ppolicy' before binding with a
'PasswordPolicyControl()' unconditionally.

Regards.

Quack,

As I can see this part of the code did not change in 0.9.10.

Any news?

\_o<

Sorry for not responding sooner.

There are two nslcd implementations: nslcd and pynslcd. The pynslcd
implementation is more experimental and does not handle
pam_authc_ppolicy properly.

The nslcd implementation for which you filed the bug should handle the
option properly, e.g. see
https://arthurdejong.org/git/nss-pam-ldapd/tree/nslcd/myldap.c#n587

This option has been in nss-pam-ldapd since 0.9.7 so if you are seeing
this with nslcd, could you report the exact error your LDAP server is
logging?

The pynslcd implementation does not yet support this in a released
version but I just pushed a fix to Git:
https://arthurdejong.org/git/nss-pam-ldapd/commit/?id=fea0f5e

Thanks,

Quack,

I am using nslcd and got confused in my research in the code, sorry.

I captured logs of both nslcd (0.9.11-1) and slapd
(2.4.47+dfsg-3+deb10u1, ok and nok to compare). It is unclear to me why
ldap_parse_result() fails.

Regards.
\_o<

Hello,

I just ran into this bug. If I understand correctly it should have been
fixed by this commit:
<https://arthurdejong.org/git/nss-pam-ldapd/commit/?id=37a00e988304dd8b3b04886b56ecc713347f596f>
which is in Debian since version 0.9.12-1.

Just to be sure Arthur, would setting this option to "no" indeed make
the OpenLDAP server stop logging entries like the following?

slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1

And would it be a good idea to back-port this patch to stable ?

Regards,
Nicolas Peugnet

Yes, the pam_authc_ppolicy option is used to disable requesting that
control, see
https://arthurdejong.org/nss-pam-ldapd/nslcd.conf.5#pam_authc_ppolicy

While the option was added in 0.9.7 it was non-functional until it was
fixed in 0.9.12.

The missing control logged by the LDAP server should not be harmful in
any way because it is marked as not critical which means it is just a
warning that can be ignored.

I doubt this would be severe enough an issue to warrant an update for
bullseye.