I have a FreeIPA used mostly for LDAP-based authentication in many local web services. Unfortunately, LDAP authorizes users to login to 3-rd party applications even when user's password is expired (including first random password, that is already expired and was not yet changed).

Is there a way to configure a "policy" to refuse users with expired login everywhere but FreeIPA web interface, letting users only to change their expired password?


  • FreeIPA uses the 389 Directory Server for LDAP implementation, which doesn't seem to have a password policy manager. Probably, not what you want, but if you know when the password expires, you can nullify the userpassword attribute (which I guess what 389 is using for authenticated binds) of the user's entry. After that, 389 will most likely return LDAP RC 48 to the application which was doing the authenticated bind on behalf of the user, preventing access to whatever the resource the user was trying to get to. – Bora May 29 '18 at 5:35

No, not at the moment. Please see related upstream ticket.

What you could do, when applicable, is to authenticate users via Kerberos which does not log in users when expired. More information about the FreeIPA and available Web Application modules are on the FreeIPA.org page Web App Authentication.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.