Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configured the ppolicy overlay for OpenLDAP to enable password policies. These things work:

  • Password lockouts on too many failed attempts
  • Password Change required once pwdReset=TRUE added to user entry
  • Password Expirations

If the account is locked out due to intrusion attempts (too many bad passwords) or time (expiration time hit), the account must be reset by an administrator.

However, when the administrator sets pwdReset=TRUE in the profile, this seems to also override the expiration policy. So, the password that the administrator sent out (which should be a temporary password) ends up being valid permanently.

Is there a way in OpenLDAP to have a password that must be changed, but also MUST expire?

share|improve this question

4 Answers 4

You can set pwdMustChange=true to ppolicy and add pwdReset=true to the user,

The user will be able to bind successfully but will get a prompt: "Password must be changed".

share|improve this answer

I realize this post is fairly old but it hasn't been answered yet. I don't have any experience with OpenLDAP but with OpenDJ there's a ds-cfg-max-password-reset-age property that sets the maximum length of time a user is given to change their password after it has been reset.

Hope this helps.

share|improve this answer

It looks like you may need to add pwdMustChange:TRUE to force a change on next login. Pre-expiring the password, and disabling grace logins may also be required.

Disabling grace logins will cause problems for users who let their password expire, so you might want to increase the password expiry warning time.

share|improve this answer

I don't see why a temporary password should expire? If the user never logs in then it shouldn't expire because the user needs to select the new one so he/she knows it.

According to this on the first access of a record by a user, the user will have to change it on first authentication http://linux.die.net/man/5/slapo-ppolicy

are you saying the user can ignore changing it when he first logs back in?

share|improve this answer
1  
No, I am saying that the temporary password should only be valid for 24-48 hours (ie, it should expire if the user it was sent to doesn't login shortly after receiving it). I don't see a way to enforce this with ppolicy, though. –  jsight Oct 6 '10 at 13:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.