Re: detecting password expiration warnings by admin

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Saturday, 13 March 2010 01:17:19 Tyler Gates wrote:
> Hi Guys,
>     We are currently looking into implementing password expirations
> (pwdMaxAge) along with password expiration warnings (pwdExpireWarning)
> so that email notifications may be sent to those offending entries via a
> cronjob run as the admin (or some other ACL user).

You're not clear here on whether you already have a cron job for this, or 
whether you are attempting to write one.

> The problem is, if I
> understand it correctly, these warning messages are only relayed (via
> password policy controls ?) when the USER itself binds to the tree. Is
> there some other way for a privileged user to obtain these messages or
> at least some other set attribute before pwdMaxAge has been reached?

As far as I can see, no, the only way is to interpret the state values in the 
DN along with the applicable password policy.

> If
> you are thinking of increasing the pwdAuthGraceNLimit that wont work
> because the user could login and try binding several other times through
> the course of the day before receiving a "password is about to expire in
> nlogin attempts" which is preformed each time they login to their machine.
> 
> Below is an example of what works to get the info I need, binding as a
> user (again not what I want):

I have implemented as follows:

1)A script that can operate either as command-line passwd replacement, or CGI, 
which allows the user to check their password and be prompted to change it if 
it has expired, as well as handling any ppolicy errors during password change.

2)A perl script to search the directory for DN's whose passwords are about to 
expire, sending them a mail notifying them when the password will expire, with 
a link to the URL where (1) runs as a CGI

3)A script for the admin to unlock accounts that have been locked out, reset 
their password, and send them a notification.

I would like to merge (2) and (3), but I was in quite a hurry to get this 
working as I had a number of users who were locked out at the time.

The scripts (1) and (2) in their present state are available at 
http://staff.telkomsa.net/~bgmilne/ldap/ . I am still trying to resolve one or 
two issues, but they should be of use to you.

If (3) would be useful to you, I will make that available as (or, an updated 
(2) which has the functionality).

Regards,
Buchan