Re: PPolicy overlay and hidden user attributes.

[dennis@demarco.com]

Alright, I understand now:

How do I set it to return on default?

To specify pwdPolicySubEntry for each user seems a headache. If I have 
multiple users with different policies it would be nice to be able to see 
this in a browser.

Under the current implementation how could you see if an account is 
locked using a simple browse? besides checking logs or writting a script 
to request these attributes specificly for an individual user.

I understand this is something new ppolicy overlay. I am just trying to 
see how could this fit into daily usage.

Thank you,
Dennis



On Thu, 28 Apr 2005, Howard Chu wrote:

> dennis@demarco.com wrote:
>
> >  I'm playing with the password policy overlay and it seems to be working, 
> >  but I can't see any of the user attributes that the policy sets on an user 
> >  object in my ldapbrowser:
> >
> >  pwdChangedTime, pwdAccountLockedTime, pwdExpirationWarned,
> >  pwdFailureTime, pwdHistory, pwdGraceUseTime, pwdReset,
> >  pwdPolicySubEntry
>
> As the documentation states, and the schema definitions show, these are 
> operational attributes, not user attributes. Operational attributes must be 
> requested by name, they are not returned by default.