Hi,
I am trying to implement password expiration in my LDAP software. I am not using the fedora/mozilla/sun API, but the Novell API. So I can't use specific functions if they exist.
There are three concepts I would like to integrate :
- Password must be changed after a reset - Password expiration warning - Password expired
How can I detect these three events ?
Moreover, what can I do within the maximum login attempts ? Only bind then change the password ?
Thank you very much, and congratulations for this beautiful software
Regards,
François Beretti
François Beretti wrote:
Hi,
I am trying to implement password expiration in my LDAP software. I am not using the fedora/mozilla/sun API, but the Novell API. So I can't use specific functions if they exist.
There are three concepts I would like to integrate :
- Password must be changed after a reset
- Password expiration warning
- Password expired
How can I detect these three events ?
I'm not sure. You may want to ask on a Novell list to find out what is supported by their API. But in general, these events are returned to all LDAPv3 clients in the form of controls, so as long as the Novell API allows you to receive and parse the response controls, you should be able to get all of that information.
Moreover, what can I do within the maximum login attempts ? Only bind then change the password ?
Yes. Fedora DS allows a configurable number of "grace logins" - the user is only allowed to BIND, then change their password.
Thank you very much, and congratulations for this beautiful software
Regards,
François Beretti
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
On 3/31/06, Richard Megginson rmeggins@redhat.com wrote:
François Beretti wrote:
- Password must be changed after a reset
- Password expiration warning
- Password expired
How can I detect these three events ?
I'm not sure. You may want to ask on a Novell list to find out what is supported by their API. But in general, these events are returned to all LDAPv3 clients in the form of controls, so as long as the Novell API allows you to receive and parse the response controls, you should be able to get all of that information.
Thank you for your answer. Is there a description somewhere of which controls are used by the Directory Server ?
Yes. Fedora DS allows a configurable number of "grace logins" - the user is only allowed to BIND, then change their password.
Thank you again
François
François Beretti wrote:
On 3/31/06, Richard Megginson rmeggins@redhat.com wrote:
François Beretti wrote:
- Password must be changed after a reset
- Password expiration warning
- Password expired
How can I detect these three events ?
I'm not sure. You may want to ask on a Novell list to find out what is supported by their API. But in general, these events are returned to all LDAPv3 clients in the form of controls, so as long as the Novell API allows you to receive and parse the response controls, you should be able to get all of that information.
Thank you for your answer. Is there a description somewhere of which controls are used by the Directory Server ?
Yes. Fedora DS allows a configurable number of "grace logins" - the user is only allowed to BIND, then change their password.
Thank you again
The internet draft has unfortunately expired (again), but there is a recent copy of it here - http://www.dfn-pca.de/bibliothek/standards/ietf/none/internet-drafts/draft-b...
You have to specify the control with the request so that the server will know the client is aware of the response control.
See section 5 and later for details about the control OID to send, what is available in the response, and the behavior for different operations.
François
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
389-users@lists.fedoraproject.org
-
François Beretti -
Rich Megginson