OpenLDAP Password Expiration with pwdReset=TRUE?

Question

I have configured the ppolicy overlay for OpenLDAP to enable password policies. These things work:

• Password lockouts on too many failed attempts
• Password Change required once pwdReset=TRUE added to user entry
• Password Expirations

If the account is locked out due to intrusion attempts (too many bad passwords) or time (expiration time hit), the account must be reset by an administrator.

However, when the administrator sets pwdReset=TRUE in the profile, this seems to also override the expiration policy. So, the password that the administrator sent out (which should be a temporary password) ends up being valid permanently.

Is there a way in OpenLDAP to have a password that must be changed, but also MUST expire?

Answer 1

I don't see why a temporary password should expire? If the user never logs in then it shouldn't expire because the user needs to select the new one so he/she knows it.

According to this on the first access of a record by a user, the user will have to change it on first authentication http://linux.die.net/man/5/slapo-ppolicy

are you saying the user can ignore changing it when he first logs back in?

Answer 2

I realize this post is fairly old but it hasn't been answered yet. I don't have any experience with OpenLDAP but with OpenDJ there's a ds-cfg-max-password-reset-age property that sets the maximum length of time a user is given to change their password after it has been reset.

Hope this helps.

Answer 3

You can set pwdMustChange=true to ppolicy and add pwdReset=true to the user,

The user will be able to bind successfully but will get a prompt: "Password must be changed".

Answer 4

It looks like you may need to add pwdMustChange:TRUE to force a change on next login. Pre-expiring the password, and disabling grace logins may also be required.

Disabling grace logins will cause problems for users who let their password expire, so you might want to increase the password expiry warning time.