[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: comments on ldap password policy draft
At 10:46 AM 10/25/99 -0600, Jim Sermersheim wrote:
>>If you want to avoid the policy fetch for each bind, you
>>could store both a timestamp of last password modification
>>and the expiration time.
>
>I'm not sure how that would help. Wouldn't we still need to look at the policy (in case it changed?)
No. pwdExpirationTime would be computed on every policy change
based upon pwdPasswordTimeStamp. The advantage of having
pwdPasswordTimeStamp is that you have a reference time to
use in computing pwdExpirationTime.
If pwdPasswordTimeStamp didn't exist for some reason when the
policy was changed, then you would have to fall back to either:
1) expire now
2) expire policy seconds from now.
The choice, of course, could be a matter of policy.
----
Kurt D. Zeilenga <kurt@boolean.net>
Net Boolean Incorporated <http://www.boolean.net/>