Re: OpenLDAP user credentials lifetime issue

[Howard Chu <hyc@symas.com>]

Buchan Milne wrote:
> On Tuesday 02 January 2007 13:34, Alina Dubrovska wrote:
> > I have inspected slapo-ppolicy(5) overlay functionality, seems that:
> >
> > "pwdMaxAge=<lifetime>" + "pwdGraceAuthnLimit=0"
> >
> > would help, but then I need to setup separate policy for each user with
> > different lifetime (not acceptable).
>
> To be completely accurate, you would create a policy, and apply that policy to 
> individual entries by setting the pwdPolicySubentry attribute of that entry 
> to the DN of the policy.

This is completely true and correct today, but that's not how it is meant to 
work in the future. Just a little FYI... Subentries are actually intended to 
follow the X.500 administration model, using subtree search specifications to 
define the range of the tree over which they apply. I.e., in X.500 you would 
create a pwdPolicy subentry at some administration point in the DIT, defining 
the policy and the range of entries that are to be subject to the policy. And 
then the directory is supposed to dynamically populate the pwdPolicySubentry 
operational attribute of all the affected entries, indicating which subentry 
controls them. For now OpenLDAP lacks true subentry support. When the support 
is added in the future, these pwdPolicySubentry operational attributes will 
be read-only, dynamically generated based on the specifications in the actual 
pwdPolicy subentries.

Given the lack of real subentry support it was easier to do things this way, 
but in hindsight we should have made the ppolicy overlay dynamically generate 
the operational attributes itself. The current implementation gives a wrong 
indication of how subentries should normally work...

> > I would like to ask if slapd(8) offers features (in addition to
> > slapo-ppolicy) to control the lifetime of directory users' credentials? Is
> > there a convenient way to implement such requirement?
>
> Note the ppolicy_default option, documented in the man page, which allows you 
> to have a default password policy for the entire database (which you would 
> override if necessary as above).
>
> Regards,
> Buchan


--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc
  OpenLDAP Core Team            http://www.openldap.org/project/