how to get password expiration warnings and password policy

[Ondrej Ivanič]

Hi,

Is there any way how to query user's password policy related
attributes? I'm interested in password expiration date in order to
show warning message.
PHP has ldap_parse_result(link, result, ...) function but there is no
result from ldap_bind() (which calls ldap_bind_s()) function (except
simple true/false).

When I set password policy for server I can query cn=config and get
password policy definition. When I set password policy for subtree I
can't find any password policy related attributes.

I tried to search using baseDN which is in 'pwdpolicysubentry' (
'cn="cn=nsPwTemplateEntry,dc=example",cn=nsPwPolicyContainer,dc=example'
) but nothing is there:
dn: cn="cn=nsPwTemplateEntry,dc=example",cn=nsPwPolicyContainer,dc=ex
 ample
objectClass: extensibleObject
objectClass: costemplate
objectClass: ldapsubentry
objectClass: top
cosPriority: 1
cn: "cn=nsPwTemplateEntry,dc=example"


Thanks,
-- 
Ondrej Ivanic
(ondrej.ivanic(a)gmail.com)

[Morris, Patrick]

  On 9/23/2010 8:13 PM, Ondrej Ivanič wrote:
>  Hi,
>
>  Is there any way how to query user's password policy related
>  attributes? I'm interested in password expiration date in order to
>  show warning message. 
Just look for "passwordExpirationTime" on the account entry.  You'll 
need to ask for it specifically.

[Aaron Hagopian]

This only tells you if their password has expired but you will not know if
there are grace logins and this also doesn't tell you give you password
warnings without trying to lookup the policy.  You can get all of the
password information using ldap extended operations (part of LDAP v3 I
think).

I am using this with great success in java but not sure how much is
implemented in PHP.  Maybe someone on this list or a php list may know
better.



2010/9/24 Morris, Patrick <patrick.morris(a)hp.com&gt;

>   On 9/23/2010 8:13 PM, Ondrej Ivanič wrote:
>  > Hi,
>  >
>  > Is there any way how to query user's password policy related
>  > attributes? I'm interested in password expiration date in order to
>  > show warning message.
>
>  Just look for "passwordExpirationTime" on the account entry.  You'll
>  need to ask for it specifically.
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Morris, Patrick]

  It's not true that this only tells you if it has expired.  It tells 
you *when* it will expire if it's going to, which is what Ondrej said he 
was looking for.  If you want to know, for example, if someone's 
password will expire within a week, that field will tell you.

On 9/24/2010 9:51 AM, Aaron Hagopian wrote:
>  This only tells you if their password has expired but you will not 
>  know if there are grace logins and this also doesn't tell you give you 
>  password warnings without trying to lookup the policy.  You can get 
>  all of the password information using ldap extended operations (part 
>  of LDAP v3 I think).
>
>  I am using this with great success in java but not sure how much is 
>  implemented in PHP.  Maybe someone on this list or a php list may know 
>  better.
>
>
>
>  2010/9/24 Morris, Patrick <patrick.morris(a)hp.com 
>  <mailto:[e-mail]>>
>
>       On 9/23/2010 8:13 PM, Ondrej Ivanič wrote:
>      > Hi,
>      >
>      > Is there any way how to query user's password policy related
>      > attributes? I'm interested in password expiration date in order to
>      > show warning message.
>
>      Just look for "passwordExpirationTime" on the account entry.  You'll
>      need to ask for it specifically.
>      --
>      389 users mailing list
>      389-users(a)lists.fedoraproject.org
>      <mailto:[e-mail]>
>      https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>

[Aaron Hagopian]

What I meant is all you know is the expiration date.  You will not know any
of the expiration information on top of that like when to start warning, if
they have already been warned or if they have used grace logins.  The reason
these LDAP v3 requests exist is to be able to get extra information just
like this.

2010/9/24 Morris, Patrick <patrick.morris(a)hp.com&gt;

>   It's not true that this only tells you if it has expired.  It
> tells you
>  *when* it will expire if it's going to, which is what Ondrej said he was
>  looking for.  If you want to know, for example, if someone's password will
>  expire within a week, that field will tell you.
>
>
>  On 9/24/2010 9:51 AM, Aaron Hagopian wrote:
>
>  This only tells you if their password has expired but you will not know if
>  there are grace logins and this also doesn't tell you give you password
>  warnings without trying to lookup the policy.  You can get all of the
>  password information using ldap extended operations (part of LDAP v3 I
>  think).
>
>   I am using this with great success in java but not sure how much is
>  implemented in PHP.  Maybe someone on this list or a php list may know
>  better.
>
>
>
>   2010/9/24 Morris, Patrick <patrick.morris(a)hp.com&gt;
>
> >   On 9/23/2010 8:13 PM, Ondrej Ivanič wrote:
> > > Hi,
> > >
> > > Is there any way how to query user's password policy related
> > > attributes? I'm interested in password expiration date in order to
> > > show warning message.
> >
> >  Just look for "passwordExpirationTime" on the account entry.  You'll
> > need to ask for it specifically.
> >  --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Ondrej Ivanič]

Hi,

I realised that I queried wrong DN and correct one is:
cn=nsPwPolicyEntry not cn=nsPwTemplateEntry:
dn: cn="cn=nsPwPolicyEntry,dc=example",cn=nsPwPolicyContainer,dc=example
passwordMustChange: off
passwordExp: off
passwordMinAge: 0
passwordChange: off
passwordStorageScheme: ssha
passwordLockout: on
passwordLockoutDuration: 1800
passwordResetFailureCount: 1800
passwordUnlock: on
passwordMaxFailure: 6
passwordCheckSyntax: on
passwordMinLength: 10
passwordMinDigits: 3

It seems that password policy for sub tree doesn't work correctly -- I
used console (centos 8.1 directory server) to set it but if I set
password policy for server then it works correctly. Is this a known
bug?

When I activated password lockout for whole server I was able to query
user DN and get all password policy related attributes. Moreover login
failed when I reach number of failed logins specified by password
policy. This didn't happend for password policy activated for sub
tree. (via console).

I will try to set password policy using ldif files and post my finding here.

2010/9/24 Ondrej Ivanič <ondrej.ivanic(a)gmail.com&gt;:
>  When I set password policy for server I can query cn=config and get
>  password policy definition. When I set password policy for subtree I
>  can't find any password policy related attributes.
>
>  I tried to search using baseDN which is in 'pwdpolicysubentry' (
>
> 'cn="cn=nsPwTemplateEntry,dc=example",cn=nsPwPolicyContainer,dc=example'
>  ) but nothing is there:
>  dn: cn="cn=nsPwTemplateEntry,dc=example",cn=nsPwPolicyContainer,dc=ex
>   ample
>  objectClass: extensibleObject
>  objectClass: costemplate
>  objectClass: ldapsubentry
>  objectClass: top
>  cosPriority: 1
>  cn: "cn=nsPwTemplateEntry,dc=example" 
Thanks,
-- 
Ondrej Ivanic
(ondrej.ivanic(a)gmail.com)