Re: [ldapext] Re: Password Policy for LDAP Directories

Jim

>>> Gabriele Garuglieri <gabriele.garuglieri@infoblu.it> 10/27/04 12:09:46 AM >>>
Hi all,
i agree with that, it make sense.
I think this imply that when we are in the pwdExpireWarning period, the
PasswordPolicyResponseValue, timeBeforeExpiration will always have the
predictable value of pwdMaxAge - current time, does it?
Regards, Gabriele.

Jim Sermersheim wrote:

> I believe the intent (however wrongly formulated) was to allow the
> user to receive a warning no matter what. Even if the password's max
> age has passed, the user would be allowed pwdExpireWarning seconds to
> change the pwd. The definition of pwdExpireWarning talks about this in
> a not very precise way (The number of seconds before the password will
> expire after the user is first warned of its upcoming expiration.)
>
> Some history to help make sense of things:
>
> The password policy I-D was created as a blend of the (then) Netscape
> and Novell directory password policies.
>
> I believe the original implementors of pwdExpireWarning (Netscape)
> used this to both warn of expiration, and also allow some kind of
> grace login period.
> Novell's implementation didn't include the notion of a warning period.
> Only a number of grace logins.
>
> So now we have two ways of achieving 'grace login'.
>
> A better way of specifying the pwdExpireWarning and pwdMaxAge concepts
> would have been to use one attribute to specify an age at which an
> expiration warning is sent, and another attribute specified how long
> these warnings will continue before the password finally expires.
>
> I dislike having two similar but different grace mechanisms, so I
> propose that we remove pwdExpireWarned, and expire the password when
> it reaches pwdMaxAge (regardless of whether any warnings have been sent).
>
> I'll update the I-D to reflect this without debate (because the
> deadline is so near), and we can go from there.
>
> Jim
>
> >>> Andrew Sciberras < andrew.sciberras@eB2Bcom.com > 9/14/04 7:48:25 PM >>>
> Hi Niel,
>
>
> Neil Dunbar wrote:
> <SNIP>
> > The pwdMaxAge should be the absolute maximum time that the password can
> > be used by anyone as a credential. The pwdExpirationWarning time, I
> > think, should be the earliest opportunity that the directory server can
> > warn the user that his/her password is approaching expiry. If the user
> > comes into the expiry period late in the game - tough. You can always
> > use the grace logins feature to allow the user with the dud password to
> > change it after it has ceased to be a meaningful credential for general
> > directory operations
> </SNIP>
>
>
> If someone was to implement the draft in its current form, their first
> warning time would indicate the time difference between the current time
> and the time that the password is due to expire. Subsequent logins would
> result in a warning time that will go beyond the specified pwdMaxAge
> allowing the user to receive their full warning period.
>
> Our implementation, which was based around the -05 version of the draft
> handled this inconsistency by returning an initial warning message of
> pwdExpireWarning.
>
> I've now noticed, in version -07 of the draft, that the following new
> line exists within the description of pwdExpireWarning:
> If not 0, the value must be smaller than the value of the pwdMaxAge
> attribute.
>
> This seriously implies that the author's intention is to ensure that the
> warning time does not exceed the maximum age of the password.
>
> I'm not extremely passionate about whether a user should receive their
> full warning period. Some consensus on this issue, and the author's
> opinion (Jim?) would be good though.
>
>
> Andrew Sciberras
> eB2Bcom - Software Engineer

--
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°
° Gabriele Garuglieri °
° Infoblu S.p.A °
° c/o Nuovo Centro Direzionale °
° Autostrade // per l'Italia °
° svincolo autostradale Firenze Nord °
° 50013 Campi Bisenzio - Firenze °
° ======================================== °
° email: gabriele.garuglieri@infoblu.it °
° phone: +390554202832 °
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°