I am running openldap 2.3.43.el5 on RHEL 5.3 I am trying to find a simple command that will tell you when the password for an ldap user will expire, any help would be greatly appreciated.This would be an equivalent of chage -l (for local linux accounts.

I have just managed to change the pwdmaxAge attribute in our environment and need a definite way to check if the change has taken effect (not just by querying the atribute pwdMaxAge with ldapsearch

Help Please ?

  • What is your problem with ldapsearch? – quanta Aug 30 '12 at 16:03

There isn't one. The only thing that can help you is the operational attribute pwdChangedTime, which you can see via ldapsearch. When this gets older than pwdMaxAge in the password policy, the password expires. The only way to test it exactly is to wait out the expiration periond.

| improve this answer | |
  • Thanks very much for your help anyway..i have reset my pwdmaxAge t 90 days , i guess i have to wait until then to see if it worked or not.Thanks – Dominiqs Aug 31 '12 at 13:20
  • @Dominiqs You don't have to wait that long. Make yourself a test password policy with max age 1 day, make a test account with that policy, change its password, wait a day, ... – Marquis of Lorne Sep 1 '12 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.