On pwdGraceUseTime granularity

[Matus Honek <mhonek@redhat.com>]

Hello,

currently, granularity of pwdGraceUseTime is one second. This allows
client to successfully bind with old password as many times as they
want during N seconds (where N is equal to pwdGraceAuthnLimit) which
may be unwanted. Would it be possible to increase the granularity, and
if so, what size would make sense? Could it be made configurable?

FWIW, I know that basically every major LDAP server has one second
granularity, and that this does not mitigate the actual issue (only
lowers the time window during which this can be misused).

Thanks and regards.
-- 
Matúš Honěk
Software Engineer
Red Hat Czech