Re: Admin roles by group membership per OU

[Ervin Hegedüs <airween@gmail.com>]

Hi Michael,

On Thu, Oct 12, 2017 at 10:34:09PM +0200, Michael Ströder wrote:
> Ervin Hegedüs wrote:
> > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write
> 
> Additional side notes regarding this ACL above (which is often used in
> tutorials):
> 
> 1. You should use slapo-ppolicy instead of deprecated 'shadowLastChange'
> attribute to enforce password expiry.

thanks - I'm relative "new" (recurrent after many years) in
OpenLDAP. Most concept is very new for me, especially this one
above (slapo-ppolicy).

I have to read the related documentation.

> 2. With this ACL the user can extend the password validity period
> himself which renders password expiry ineffective.

good catch, I'll review the rules again tomorrow.

Thanks again!
 


a.