RE: detecting password expiration warnings by admin

["John Kane" <john.kane@prodeasystems.com>]

Hey Buchan,

find-ldap-expired.pl

on the link you posted gives an "Access forbidden" (I can get all
others).

Thanks,
John


-----Original Message-----
From:
openldap-technical-bounces+john.kane=prodeasystems.com@OpenLDAP.org
[mailto:openldap-technical-bounces+john.kane=prodeasystems.com@OpenLDAP.
org] On Behalf Of Buchan Milne
Sent: Monday, March 15, 2010 6:06 AM
To: openldap-technical@openldap.org
Cc: Tyler Gates
Subject: Re: detecting password expiration warnings by admin

On Saturday, 13 March 2010 01:17:19 Tyler Gates wrote:
> Hi Guys,
>     We are currently looking into implementing password expirations
> (pwdMaxAge) along with password expiration warnings (pwdExpireWarning)
> so that email notifications may be sent to those offending entries via
a
> cronjob run as the admin (or some other ACL user).

You're not clear here on whether you already have a cron job for this,
or 
whether you are attempting to write one.

> The problem is, if I
> understand it correctly, these warning messages are only relayed (via
> password policy controls ?) when the USER itself binds to the tree. Is
> there some other way for a privileged user to obtain these messages or
> at least some other set attribute before pwdMaxAge has been reached?

As far as I can see, no, the only way is to interpret the state values
in the 
DN along with the applicable password policy.

> If
> you are thinking of increasing the pwdAuthGraceNLimit that wont work
> because the user could login and try binding several other times
through
> the course of the day before receiving a "password is about to expire
in
> nlogin attempts" which is preformed each time they login to their
machine.
> 
> Below is an example of what works to get the info I need, binding as a
> user (again not what I want):

I have implemented as follows:

1)A script that can operate either as command-line passwd replacement,
or CGI, 
which allows the user to check their password and be prompted to change
it if 
it has expired, as well as handling any ppolicy errors during password
change.

2)A perl script to search the directory for DN's whose passwords are
about to 
expire, sending them a mail notifying them when the password will
expire, with 
a link to the URL where (1) runs as a CGI

3)A script for the admin to unlock accounts that have been locked out,
reset 
their password, and send them a notification.

I would like to merge (2) and (3), but I was in quite a hurry to get
this 
working as I had a number of users who were locked out at the time.

The scripts (1) and (2) in their present state are available at 
http://staff.telkomsa.net/~bgmilne/ldap/ . I am still trying to resolve
one or 
two issues, but they should be of use to you.

If (3) would be useful to you, I will make that available as (or, an
updated 
(2) which has the functionality).

Regards,
Buchan



This message is confidential to Prodea Systems, Inc unless otherwise indicated 
or apparent from its nature. This message is directed to the intended recipient 
only, who may be readily determined by the sender of this message and its 
contents. If the reader of this message is not the intended recipient, or an 
employee or agent responsible for delivering this message to the intended 
recipient:(a)any dissemination or copying of this message is strictly 
prohibited; and(b)immediately notify the sender by return message and destroy 
any copies of this message in any form(electronic, paper or otherwise) that you 
have.The delivery of this message and its information is neither intended to be 
nor constitutes a disclosure or waiver of any trade secrets, intellectual 
property, attorney work product, or attorney-client communications. The 
authority of the individual sending this message to legally bind Prodea Systems  
is neither apparent nor implied,and must be independently verified.