Re: how to check user lock status

To: openldap-technical@openldap.org

Subject: Re: how to check user lock status

From: Abdelhamid MEDDEB <abdelhamid@meddeb.net>

Date: Mon, 20 Apr 2015 08:19:56 +0200

Dkim-signature: v=1; a=rsa-sha256; c=simple/simple; d=meddeb.net; s=20140924; h=from:subject:date:message-id:to:mime-version:content-type:in-reply-to: references; bh=9qppxRi8GOy9qijO67vjwS583j/C5zSXki4J9GHv5jE=; b=DleYwJMBFWXO+B/Ib2awFtJj8LrVmMMGlN4WY1eLIuxJKfgXh3RE9P/LaiojuAZuIjRcb1UJpo0Vz v1HSGueA4hLT1CCn3xjww6s9wCDeFwfTqYq4HHM/dhwqg3yZQ+HhUDk8PUQ/qvMDvPfAg/QSnmw6mr tIXb4fW+18mS2AVc=

In-reply-to: <002801d077ff$3184ffb0$948eff10$@163.com>

References: <002801d077ff$3184ffb0$948eff10$@163.com>

User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0

Hi,

For lock status of the user account you may check his pwdAccountLockedTime attribute

pwdMustChange value is overridden by pwdReset, may be the value of this attribute is set to FALSE when you've does your test ?

Cheers.

Le 16/04/2015 06:38, rockwang a écrit :

Hi, all

I set policy for user as following

# default, policies, abc.com

dn: cn=default,ou=policies,dc=abc,dc=com

objectClass: top

objectClass: device

objectClass: pwdPolicy

cn: default

pwdAttribute: userPassword

pwdMaxAge: 7776002

pwdExpireWarning: 432000

pwdInHistory: 3

pwdCheckQuality: 1

pwdMinLength: 8

pwdMaxFailure: 5

pwdLockout: TRUE

pwdLockoutDuration: 900

pwdGraceAuthNLimit: 0

pwdFailureCountInterval: 0

pwdMustChange: TRUE

pwdAllowUserChange: TRUE

pwdSafeModify: FALSE

my question is how to check user lock status. Another question is pwdMustChange doesn’t work in linux client when user first login.

Rock.wang

-- 
*Abdelhamid MEDDEB*
http://www.meddeb.net

Attachment: smime.p7s
Description: Signature cryptographique S/MIME

References:

how to check user lock status
- From: "rockwang" <studyfordo@163.com>