I'm supporting dsee7 (Oracle/Sun LDAP server) and I have a "specialized password policy" for non human accounts called, SrvsPasswdPolicy.

"pwdPolicySubentry: cn=SrvsPasswdPolicy,cn=config"

I need to modify pwdMaxAge so that passwords never expire. Why passwords were set on these accounts in the first place I'll probably never know . . .

At this point I can't even figure out how to print the policy to screen.

Should I be using dsconf or ldapsearch?

OK, remembered how to print the policy:

cn=SrvcsPasswdPolicy,cn=config objectClass- top objectClass- ldapsubentry objectClass- pwdPolicy objectClass- sunPwdPolicy cn- ServcsPasswdPolicy description- A password policy intended for proxy or service accounts. pwdAllowUserChange- FALSE pwdAttribute- userPassword pwdCheckQuality- 0 pwdExpireWarning- 0 pwdInHistory- 0 pwdLockout- FALSE pwdMaxAge- 0 pwdMinAge- 0 pwdMaxFailure- 32700 pwdMustChange- FALSE passwordStorageScheme- SSHA passwordRootdnMayBypassModsChecks- off pwdMinLength- 6

1 Answer 1


In your update, I can see you already have set a pwdMaxAge of 0, so this is unnecesary.

ldapmodify -h server -D BINDUSER -w bindpwd
dn: cn=SrvsPasswdPolicy,cn=config
changetype: modify
replace: pwdMaxAge
pwdMaxAge: 0

Remember to delete the passwordexpirationtime attribute of those users!

Use this search filter to check which users have expiration times:

  • using ldapmodify? Using an ldif file?
    – mr.zog
    Aug 7, 2014 at 19:21
  • ldapmodify -v -a -f ServicePasswdPolicy.ldif -D 'cn=Directory Manager' replace pwdMaxAge: 0 !modifying entry "cn=SrvcsPasswdPolicy,cn=config" Thanks for the answer!
    – mr.zog
    Aug 7, 2014 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.