Configure your LDAP installation to use the LDAP password filter plugin

Find the dse.ldif file.

The file is usually located in <slapd-servername>/config.

Edit the file by appending the following two sections:

   dn: cn=Psynch Check Password,cn=plugins,cn=config 
   objectclass: top 
   objectclass: nsSlapdPlugin 
   objectclass: extensibleObject 
   cn: Hitachi ID Check Password 
   nsslapd-pluginPath: /usr/local/psunix/default/psldap-sunldap.so 
         
   nsslapd-pluginInitfunc: prepasswd_init 
   nsslapd-pluginType: preoperation 
   nsslapd-pluginEnabled: on 
   nsslapd-pluginarg0: -cfg 
   nsslapd-pluginarg1: /usr/local/psunix/default/psldap.cfg 
   nsslapd-pluginID: password-preop 
   nsslapd-pluginVersion: none 
   nsslapd-pluginVendor: Hitachi ID 
   nsslapd-pluginDescription: Transparent Password Strength plugin 
   dn: cn=Psynch Synchronize Password,cn=plugins,cn=config 
   objectclass: top 
   objectclass: nsSlapdPlugin 
   objectclass: extensibleObject 
   cn: Hitachi ID Synchronize Password 
   nsslapd-pluginPath: /usr/local/psunix/default/psldap-sunldap.so 
   nsslapd-pluginInitfunc: postpasswd_init 
   nsslapd-pluginType: postoperation 
   nsslapd-pluginEnabled: on 
   nsslapd-pluginarg0: -cfg 
   nsslapd-pluginarg1: /usr/local/psunix/default/psldap.cfg 
   nsslapd-pluginID: password-postop 
   nsslapd-pluginVersion: none 
   nsslapd-pluginVendor: Hitachi ID 
   nsslapd-pluginDescription: Transparent Password Synchronization plugin  

If the configuration file is not specified for Unix-based servers, the default is /etc/psunix.cfg.

Save and close the file.

Create a new directory, /usr/local/psunix/default/64/ and copy psldap-sunldap.so into the 64/ folder. For example:

cd /usr/local/psunix/default/    mkdir 64 
cp psldap-sunldap.so 64/  

On 64-bit systems, the value of the nsslapd-pluginPath is entered as /usr/local/psunix/default/psldap-sunldap.so ; but the actual plugin, however, should be located in the /usr/local/psunix/default/64 directory.

Find the slapd.conf configuration file.

The file is usually located in /etc/openldap/.

Edit the configuration file, and add the following two lines to the "database mdb" section in slapd.conf:

  plugin preoperation "<path-to-psldap>"  prepasswd_init ["-cfg" "<path-to-config-file>"] 
  plugin postoperation "<path-to-psldap>"  postpasswd_init ["-cfg" "<path-to-config-file>"]  

For example:

  plugin preoperation "/usr/local/psunix/default/psldap-openldap.so" prepasswd_init "-cfg" "/usr/local/psunix/default/psunix.cfg" 
  plugin postoperation "/usr/local/psunix/default/psldap-openldap.so" postpasswd_init "-cfg" "/usr/local/psunix/default/psunix.cfg"  

If the configuration file is not specified for Unix-based servers, the default is /etc/psunix.cfg.

Save and close the file.

Stop and restart the OpenLDAP services.

To test that the plugins are loaded, run a command such as the following, replacing <password> with the password for cn=config:

  ldapsearch -D cn=config -w '<password>' -b 'cn=config' | egrep olcPlugin: 

This will return output such as the following:

  olcPlugin: {0} preoperation /usr/local/psunix/default/psldap-openldap.so prepa 
  olcPlugin: {0} postoperation /usr/local/psunix/default/psldap-openldap.so post  

Verify that the transparent password synchronization trigger is working as expected.

Run a command for a native LDAP tool and change the password of a user that Bravura Pass is managing.

For example, the ldapmodify command can be used in this case using the following steps:

1. Create a user.ldif file that contains the following (modify as appropriate for your LDAP environment):

         dn: <full dn of the user>
         changetype: modify
         replace: userPassword
         userPassword: newpassword
   

2. Run a command such as the following:

         ldapmodify -x -D "<dn of the OpenLDAP administrative account>" -W -f user.ldif

3. Confirm that the ldapmodify command runs successfully to reset the user's password.

   Ensure that the password change was captured by Bravura Pass and propagated to other target systems.

Find the ibmslapd.conf configuration file.

Edit the configuration file, and add the following two lines:

ibm-slapdPlugin: preoperation <path-to-psldap> prepasswd_init ["-cfg" "<path-to-config-file>"]
ibm-slapdPlugin: postoperation <path-to-psldap> postpasswd_init ["-cfg" "<path-to-config-file>"]

For example:

ibm-slapdPlugin: preoperation /usr/local/psunix/default/psldap-ibmldap.so prepasswd_init "-cfg" "/usr/local/psunix/default/psunix.cfg"
ibm-slapdPlugin: postoperation /usr/local/psunix/default/psldap-ibmldap.so postpasswd_init "-cfg" "/usr/local/psunix/default/psunix.cfg"

If the configuration file is not specified for Unix-based servers, the default is /etc/psunix.cfg.

Save and close the file.