2

I have a FreeIPA used mostly for LDAP-based authentication in many local web services. Unfortunately, LDAP authorizes users to login to 3-rd party applications even when user's password is expired (including first random password, that is already expired and was not yet changed).

Is there a way to configure a "policy" to refuse users with expired login everywhere but FreeIPA web interface, letting users only to change their expired password?

Regards,

Improve this question
1
  • FreeIPA uses the 389 Directory Server for LDAP implementation, which doesn't seem to have a password policy manager. Probably, not what you want, but if you know when the password expires, you can nullify the userpassword attribute (which I guess what 389 is using for authenticated binds) of the user's entry. After that, 389 will most likely return LDAP RC 48 to the application which was doing the authenticated bind on behalf of the user, preventing access to whatever the resource the user was trying to get to.
    – Bora
    Commented May 29, 2018 at 5:35

1 Answer 1

Reset to default
2

No, not at the moment. Please see related upstream ticket.

What you could do, when applicable, is to authenticate users via Kerberos which does not log in users when expired. More information about the FreeIPA and available Web Application modules are on the FreeIPA.org page Web App Authentication.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .