Environment
Novell Open Enterprise Server 2 SP2 (OES 2SP2) Linux
DSFW
Situation
Resolution
If iManager is the desired tool to modify password policies then verify the retain existing password polices was not enabled by doing the following:
grep -i xadretain /etc/opt/novell/xad/xad.ini
XADRETAINPOLICIES = no
Edit the /etc/opt/novell/xad/xad.ini file and change
XADRETAINPOLICIES =no to
XADRETAINPOLICIES = yes
An easy way to change this setting from no to yes is with sed. Run the following command to change from no to yes.
sed -i 's/^XADRETAINPOLICIES = no/XADRETAINPOLICIES = yes/g' /etc/opt/novell/xad/xad.ini
For OES11 edit the /etc/sysconfig/novell/xad2_oes11 file and set XAD_RETAIN_POLICIES="yes" so that future patches and upgrades will not remove or ignore the setting in the xad.ini file.For OES11SP1 the file is /etc/sysconfig/novell/xad_oes11_sp1
Here is the command to change the setting using sed on a OES11SP1 server
sed -i 's/^XAD_RETAIN_POLICIES="no"/XAD_RETAIN_POLICIES="yes"/g' /etc/sysconfig/novell/xad_oes11_sp1
If the GPO Management Tool is to be used in modifying password policies then be sure XADRETAINPOLICIES = no.
Using iManager change the password policy assignment to your desired password policy (XADRETAINPOLICIES = yes):
Verify the change. Do the following ldapsearch, the nspmPassworpolicyDN should have a value of your newly assigned password policy
LDAPCONF=/etc/opt/novell/xad/openldap/ldap.conf ldapsearch -Y EXTERNAL -LLL -Q -b dc=dsfw,dc=novell,dc=com -s base nspmPasswordpolicyDN
Run gposync.sh from the terminal and re-run the ldap search again to verify the newly assigned password policy is listed.
Using iManager or ldapsearch find the attribute xad-Domain-Flag:
Additional Information
If XADRETAINPOLICY = yes cosmetic errors might be seen in when gposync.sh runs.
Example:
Syncing {31B2F340-016D-11D2-945F-00C04FB984F9} Group Policy
The policy [{31B2F340-016D-11D2-945F-00C04FB984F9}] is not associated to any container.
Delete NMAS Password Policy Links
This can be ignored. To eliminate the error edit the /opt/novell/xad/sbin/gposync.sh script and make sure it looks like this. I'll highlight the changes in bold
export LDAPCONF=/etc/opt/novell/xad/openldap/ldap.conf
doma=`(ldapsearch -Y EXTERNAL -b "" -s base -LLL 2>&1) | grep -iw defaultnamingcontext | awk -F: '{print $2}' | tr -d [:space:]`
test -z "$doma" && exit
test -z "$gPolicies" && exit
for s in $gPolicies; do
echo -e "\t$s"
done
echo
XADRETAIN=`grep -i xadretainpolicies /etc/opt/novell/xad/xad.ini |awk -F= '{print $2}'`
if test $XADRETAIN == yes; then
else
for s in $gPolicies; do
echo "Syncing $s Group Policy"
$GPOTOOL "$s"
echo -e "\n"
done
fi