DB2 FOR LUW / DB2FORLUW / B50 - DB2

By default, the Db2 LDAP plugins use ldap_simple_bind for
authentication to an LDAP server. Depending on the password
policy configuration of the LDAP server, the ldap_simple_bind
may not be rejected when a user's password is expired, or the
user needs to change their password at the next logon.

This APAR adds the SASL_BIND keyword to the IBMLDAPSecurity.ini
file, which takes the following values:
- true
- false

When SASL_BIND is set to "true" in the IBMLDAPSecurity.ini file,
the LDAP plugin will instead use "ldap_sasl_bind" with the
LDAP_SASL_SIMPLE mechanism, and will add a PasswordPolicyRequest
control when authenticating users. This indicates to the LDAP
server that the LDAP plugin is requesting data about the state
of a user's password, and that the server should respond with a
passwordPolicyResponse.

If a passwordPolicyResponse control is included in the response
from the LDAP server, the LDAP plugin will examine the
passwordPolicyResponse to determine the status of the user's
password. If the passwordPolicyResponse indicates that the
user's
password is expired, or must change before the next logon,
authentication will be denied.

****************************************************************
* USERS AFFECTED:                                              *
* All DB2 systems on all Linux, Unix and Windows platforms at  *
* service levels Version 11.5 GA to 11.5.5.1                   *
****************************************************************
* PROBLEM DESCRIPTION:                                         *
* See Error Description                                        *
****************************************************************
* RECOMMENDATION:                                              *
* Upgrade to Db2 11.5.6                                        *
****************************************************************

****************************************************************
* USERS AFFECTED:                                              *
* All DB2 systems on all Linux, Unix and Windows platforms at  *
* service levels Version 11.5 GA to 11.5.5.1                   *
****************************************************************
* PROBLEM DESCRIPTION:                                         *
* See Error Description                                        *
****************************************************************
* RECOMMENDATION:                                              *
* Upgrade to Db2 11.5.6                                        *
****************************************************************

The complete fix for this problem first appears in DB2 Version
11.5.6 and all the subsequent Fix Packs. Once an updated version
of Db2 is installed, add the following keyword to
IBMLDAPSecurity.ini:

SASL_BIND = true

Date  - problem reported    :
Date  - problem closed      :
Date  - last modified       :

31.03.2021
11.06.2021
11.06.2021