Hey there,
I think that you also need:
pwdOTPValidFromTime
This way an admin can pre-configure all the OTP's and they only "become valid
from" that time frame. IE think university enrollment. You can configure all the
OTP's a month before, and they become valid at a specific datetime.
I think you should make it consistent with passwordOTPExpDelay to pwdOTPExpDelay. Better,
OTP means "one time password" so why is it "password one time
password". Just make the attributes "OTPExpDelay" or whatever. Alternately
make it pwdOT (password one time).
I think passwordOTPExpDelay can be remove if you have ValidFromTime instead.
The OC should be named onetimepasswordPolicy instead.
Hope that helps!
On 22 Mar 2021, at 21:30, thierry bordaz <tbordaz(a)redhat.com>
wrote:
Hi,
I wrote a small design [1] about OTP password policy that I would like to start
implementing.
Comments are welcome
[1]
https://www.port389.org/docs/389ds/design/otp-password-policy.html
best regards
thierry
_______________________________________________
389-devel mailing list -- 389-devel(a)lists.fedoraproject.org
To unsubscribe send an email to 389-devel-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-devel@lists.fedoraproje...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
—
Sincerely,
William Brown
Senior Software Engineer, 389 Directory Server
SUSE Labs, Australia