Description of problem:
Customer would like the current password ONLY to be rejected when updating a
user's password as himself/herself.

We currently have an attribute called passwordInHistory, which can only take
values of 1 to 24, By specifying "passwordInHistory: 1", it not only rejects
the current password but also "current password - 1"! Please see my test below:


1. Create a test user called arichardson

2. Create a user level password policy:
dn: cn=cn\3DnsPwPolicyEntry\2Cuid\3Darichardson\2Cou\3DPeople\2Cdc\3Dmytestrea
 lm\2Cdc\3Dcom,cn=nsPwPolicyContainer,ou=People,dc=mytestrealm,dc=com
objectClass: ldapsubentry
objectClass: passwordpolicy
objectClass: top
cn: cn=nsPwPolicyEntry,uid=arichardson,ou=People,dc=mytestrealm,dc=com
passwordMustChange: off
passwordExp: off
passwordMinAge: 0
passwordChange: on
passwordInHistory: 1  <<<<<<<<<<<<<<<<<<<
passwordStorageScheme: ssha512



3. Bind as the user using his current password "password"
# ldapsearch -h localhost -p 2389 -D
"uid=arichardson,ou=People,dc=mytestrealm,dc=com" -w password -b
"uid=arichardson,ou=People,dc=mytestrealm,dc=com"
# extended LDIF
#
# LDAPv3
# base <uid=arichardson,ou=People,dc=mytestrealm,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# arichardson, People, mytestrealm.com
dn: uid=arichardson,ou=People,dc=mytestrealm,dc=com
uid: arichardson
givenName: Alan
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
sn: Richardson
cn: Alan Richardson



4. Attempt to change the user arichardson's password using the current
password:
# ldapmodify -h localhost -p 2389 -D
"uid=arichardson,ou=People,dc=mytestrealm,dc=com" -w password
dn: uid=arichardson,ou=People,dc=mytestrealm,dc=com
changetype: modify
replace: userpassword
userpassword: password

modifying entry "uid=arichardson,ou=People,dc=mytestrealm,dc=com "
ldap_modify: Constraint violation (19)
        additional info: password in history



5. Replace the user arichardson's password with "Canget1n":
# ldapmodify -h localhost -p 2389 -D
"uid=arichardson,ou=People,dc=mytestrealm,dc=com" -w password
dn: uid=arichardson,ou=People,dc=mytestrealm,dc=com
changetype: modify
replace: userpassword
userpassword: Canget1n

modifying entry "uid=arichardson,ou=People,dc=mytestrealm,dc=com "


6. Now attempted to change  user arichardson's password with the current
passwod -1 , i.e. "password":
# ldapmodify -h localhost -p 2389 -D
"uid=arichardson,ou=People,dc=mytestrealm,dc=com" -w Canget1n
dn: uid=arichardson,ou=People,dc=mytestrealm,dc=com
changetype: modify
replace: userpassword
userpassword: password

modifying entry "uid=arichardson,ou=People,dc=mytestrealm,dc=com "
ldap_modify: Constraint violation (19)
        additional info: password in history


7. Now attempted to change  user arichardson's password with the current
password "Canget1n":
# ldapmodify -h localhost -p 2389 -D
"uid=arichardson,ou=People,dc=mytestrealm,dc=com" -w Canget1n
dn: uid=arichardson,ou=People,dc=mytestrealm,dc=com
changetype: modify
replace: userpassword
userpassword: Canget1n

modifying entry "uid=arichardson,ou=People,dc=mytestrealm,dc=com "
ldap_modify: Constraint violation (19)
        additional info: password in history


As you  can see from the above that both "password" (current password - 1) and
"Canget1n" (current) are rejected. The customer only wants the current
password, i.e. Canget1n, in the above example to be rejected.

If I dump out passwordHistory of the user:
dn: uid=arichardson,ou=People,dc=mytestrealm,dc=com
passwordHistory: 20180329113642Z{SSHA512}lCNNXqM9CzmtsUyXxdLomk2
 r1NJlwD10dHaYzd1nLqwuvmX7MsMaEqCtdjSyNHdoJOXMV0bdzkLZG7oKYprsnWwkbvPEVw9e

It seems that even with  "passwordInHistory: 1",the passwordhistory attribute
seems to remember the  password right before the current password and the
current password!