Must pwdReset always be set explicitly?

[Akke Bengtsson <akke.bengtsson@karolinska.se>]

The draft description of ppolicy (draft-behera-ldap-password-policy-09.txt)
from July 17 2005 says among other things
"If the value the pwdMustChange is TRUE and the modification is performed
by a password administrator, then the pwdReset attribute is set to TRUE.

My impression, using OpenLDAP up to v.2.4.10 is that it rather is
implemented as "...and the pwdReset attribute is set to TRUE, the user has
to change his password."   (i.e. to set pwdReset signals the very fact that
I am a password administrator.)?
(On the other hand - the reset of the pwdReset attribute when the user
actually chooses a new password is as expected automatically  performed by
the OpenLDAP software.)

The Behera draft expired more than two years ago - in a more recent IETF
draft by Zeilenga from march 2008, there is a suggestion to replace
pwdReset by passwdChangeRequired. Also this draft is expired by now - did
it make way into any OpenLDAP code?


Best Regards
Akke Bengtsson
IT-Forum, IT-Arkitektur och systemutveckling
Karolinska Universitetssjukhuset
141 86  STOCKHOLM