Re: dsidm utility inconsistencies
by Mark Reynolds
On 9/22/21 2:58 PM, Michael Starling wrote:
>
> Unless I'm interpreting the man pages, and documentation wrong there
> seems to be some issues with the dsidm utility. Perhaps I'm doing
> something wrong?
>
>
> This works.
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account get-by-dn
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> cn: Mike Starling
>
> gecos: Mike Starling test account
>
> gidNumber: 100
>
> givenName: Mike
>
> homeDirectory: /home/mstarlingt
>
> loginShell: /bin/ksh
>
> mail: mstarling(a)mydomain.com
>
> objectClass: person
>
> objectClass: organizationalPerson
>
> objectClass: inetOrgPerson
>
> objectClass: posixAccount
>
> objectClass: top
>
> objectClass: shadowAccount
>
> shadowExpire: 99999
>
> shadowLastChange: 18857
>
> shadowMax: 33
>
> shadowWarning: 1
>
> sn: Starling
>
> uid: mstarlingt
>
> uidNumber: 25574
>
>
> #Password reset works
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account reset_password
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
>
> CONFIRM - Enter new password for
> uid=mstarlingt,ou=People,dc=mydomain,dc=com :
>
> reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
>
>
> #Unable to lock the account.
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock uid=mstarlingt
>
> *Error: No such object*
>
> *
> *
>
> *I consult the help which says to specify the dn*
>
> *
> *
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock -h
>
> usage: dsidm instance account lock [-h] [dn]
>
> positional arguments:
>
> dnThe dn to lock
>
> optional arguments:
>
> -h, --helpshow this help message and exit
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> Error: search_ext() argument 1 must be str, not None
>
I think this is a known bug (which was fixed). What version of
python-lib389 is installed?
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Error: search_ext() argument 1 must be str, not None
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b
> dc=mydomain,dc=com account lock "uid=mstarlingt"
>
>
> I tried changing the base to the People OU where the account lives
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> ou=People,dc=mydomain,dc=com account lock
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Error: search_ext() argument 1 must be str, not None
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : mstarlingt
>
> Error: No object exists given the filter criteria mstarlingt
>
What is in the access log?
Thanks,
Mark
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> Error: No object exists given the filter criteria
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : uid=mstarlingt
>
> Error: No object exists given the filter criteria uid=mstarlingt
>
>
>
>
> _______________________________________________
> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--
Directory Server Development Team
1 year, 4 months
dsidm utility inconsistencies
by Michael Starling
Unless I'm interpreting the man pages, and documentation wrong there seems to be some issues with the dsidm utility. Perhaps I'm doing something wrong?
This works.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account get-by-dn uid=mstarlingt,ou=People,dc=mydomain,dc=com
dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
cn: Mike Starling
gecos: Mike Starling test account
gidNumber: 100
givenName: Mike
homeDirectory: /home/mstarlingt
loginShell: /bin/ksh
mail: mstarling(a)mydomain.com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowExpire: 99999
shadowLastChange: 18857
shadowMax: 33
shadowWarning: 1
sn: Starling
uid: mstarlingt
uidNumber: 25574
#Password reset works
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account reset_password "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
CONFIRM - Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
#Unable to lock the account.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt
Error: No such object
I consult the help which says to specify the dn
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock -h
usage: dsidm instance account lock [-h] [dn]
positional arguments:
dn The dn to lock
optional arguments:
-h, --help show this help message and exit
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b dc=mydomain,dc=com account lock "uid=mstarlingt"
I tried changing the base to the People OU where the account lives
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b ou=People,dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : mstarlingt
Error: No object exists given the filter criteria mstarlingt
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: No object exists given the filter criteria uid=mstarlingt,ou=People,dc=mydomain,dc=com
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt
Error: No object exists given the filter criteria uid=mstarlingt
1 year, 4 months
attribute passwordMinLength cfg issues/error
by Ghiurea, Isabella
As part of user global policy we need to configure user password min length , see my cfg in dse.ldif , when trying to update a user password to a password with length > 0 seeing the following error:.
Result: Constraint violation (19)
Additional info: Failed to update password
Is there a plugin I need to install or what I am missing from this cfg ?
Here is my only changes I have in dse.ldif :
nsslapd-pwpolicy-inherit-global: on
nsslapd-pwpolicy-local: off
passwordTrackUpdateTime: on
passwordCheckSyntax: on
passwordMinLength: 8
Isabella
1 year, 4 months
can't get admin console to connect
by Chase Miller
I have done many of 389 ldap server setups.
Have a new install, and I can't get for the life of me able to get the
admin console to connect to the server.
Message i get is
[Tue Sep 21 14:55:44.279828 2021] [:notice] [pid 1337:tid 140593598555904]
[client xx.xx.xx.xxx:61796] admserv_check_authz(): passing
[/admin-serv/authenticate] to the userauth handler
Yes, I have read the documentation; i have modified the
any suggestions?
replace: nsAdminAccessAddresses
nsAdminAccessAddresses: 192.168.1.*
-
replace: nsAdminAccessHosts
nsAdminAccessHosts: *
1 year, 4 months
ns-newpolicy/pl documentation/use case
by Ghiurea, Isabella
Hi List
I am searching for some documentation for ns-newpolicy.pl file , as per RH Doc I can use that script to add the attribute : pwdUpdateTime to each uid entry after I already cfg in DS Password TrackUpdateTime and pwdpolicy- inherit -global to 'on';
Thank you
Isabella
1 year, 4 months
Announcing 389 Directory Server 1.4.4.17
by Mark Reynolds
389 Directory Server 1.4.4.17
The 389 Directory Server team is proud to announce 389-ds-base
version 1.4.4.17
Fedora packages are available on Fedora 33.
Fedora 33:
https://koji.fedoraproject.org/koji/taskinfo?taskID=76027095
<https://koji.fedoraproject.org/koji/taskinfo?taskID=76027095> - Koji
https://bodhi.fedoraproject.org/updates/FEDORA-2021-1c2247a1ec
<https://bodhi.fedoraproject.org/updates/FEDORA-2021-1c2247a1ec> - Bohdi
The new packages and versions are:
*
389-ds-base-1.4.4.17-1
Source tarballs are available for download at Download
389-ds-base Source
<https://github.com/389ds/389-ds-base/archive/389-ds-base-1.4.4.17.tar.gz>
Highlights in 1.4.4.17
*
Bug fixes
*
Cockpit UI migrated to Patternfly 4 (fixed all security vulnerabilities)
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use **dnf install 389-ds-base**
To install the Cockpit UI plugin use **dnf install cockpit-389-ds**
After rpm install completes, run **dscreate interactive**
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source
<https://www.port389.org/docs/389ds/development/source.html> for
information about source tarballs and SCM (git) access.
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
<https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...>
If you find a bug, or would like to see a new feature, file it in our
GitHub project: https://github.com/389ds/389-ds-base
<https://github.com/389ds/389-ds-base>
*
Bump version to 1.4.4.17
*
Issue 4927 - rebase lib389 and cockpit in 1.4.4
*
Issue 4908 - Updated several dsconf –help entries (typos, wrong
descriptions, etc.)
*
Issue 4912 - Account Policy plugin does not set the config entry DN
*
Issue 4796 - Add support for nsslapd-state to CLI & UI
*
Issue 4894 - IPA failure in ipa user-del –preserve (#4907)
*
Issue 4169 - backport lib389 cert list fix
*
Issue 4912 - dsidm command crashing when account policy plugin
is enabled
*
Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
*
Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks
*
Issue 4696 - Password hash upgrade on bind (#4840)
*
Issue 4875 - CLI - Add some verbosity to installer
*
Issue 4884 - server crashes when dnaInterval attribute is set to zero
*
Issue 4877 - RFE - EntryUUID to validate UUIDs on fixup (#4878)
*
Issue 4734 - import of entry with no parent warning (#4735)
*
Issue 4872 - BUG - entryuuid enabled by default causes replication
issues (#4876)
*
Issue 4763 - Attribute Uniqueness Plugin uses wrong subtree on
ModRDN (#4871)
*
Issue 4851 - Typos in “dsconf pwpolicy set –help” (#4867)
*
Issue 4736 - lib389 - fix regression in certutil error checking
*
Issue 4736 - CLI - Errors from certutil are not propagated
*
Issue 4460 - Fix isLocal and TLS paths discovery (#4850)
*
Issue 4443 - Internal unindexed searches in syncrepl/retro changelog
*
Issue 4817 - BUG - locked crypt accounts on import may allow all
passwords (#4819)
*
Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
*
Issue 4262 - Fix Index out of bound in fractional test (#4828)
*
Issue 4822 - Fix CI temporary password: fixture leftover breaks
them (#4823)
*
Issue 4656 - remove problematic language from ds-replcheck
*
Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
*
Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
*
Issue 4788 - CLI should support Temporary Password Rules
attributes (#4793)
*
Issue 4506 - Improve SASL logging
*
Issue 4093 - Fix MEP test case
*
Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
*
Issue 4789 - Temporary password rules are not enforce with local
password policy (#4790)
*
Issue 4797 - ACL IP ADDRESS evaluation may corrupt
c_isreplication_session connection flags (#4799)
*
Issue 4447 - Crash when the Referential Integrity log is manually edited
*
Issue 4773 - Add CI test for DNA interval assignment
*
Issue 4750 - Fix compiler warning in retrocl (#4751)
1 year, 4 months
Audit entries of Account Policy Plug-In behavior
by Claudionor Raymundo
Hi folks.
There is any way to deactivate audit of lastlogintime in audit file, in the directory server with Account Policy Plug-In enabled?
My directory server have 190,000+ users, and many of then logs 200 a 300 times a day (emails clients, development tools, etc) and this behavior pollutes the audit log. But i want to maintain Account Policy Plug-In enabled to control inactive users.
Thanks for any help you can provide.
1 year, 4 months
Re: global passwd policy for DS with existing users
by Thierry Bordaz
On 9/14/21 4:33 PM, Ghiurea, Isabella wrote:
>
> Thank you both of you ,
>
> From the documentation pointed by Thierry , seem the TPR ( Temporary
> Password Rule) can be the solution to have all users existing old
> password updated/force update by DS Manager( with ldap modify) and
> only next when the user logging for first time will force to change
> the passwd according to the Password Expiration Policy cfg in DS,will
> this design works?
>
This description is fulfill with passwordMustChange only. When DM reset
the password, the only thing that the user can do after he binds (using
the reset password) is to change his password.
TPR just extends that mechanism with:
* If the user does not bind/change password within a fixed delay, then
the reset password expires (temporary password)
* If the user authenticate (successfully or not) more than a fixed
number of time, then the reset password expires.
* The reset password is valid to authenticate a fixed delay after the
reset time
regards
thierry
> Isabella
>
> *From:*Thierry Bordaz [mailto:tbordaz@redhat.com]
> *Sent:* September 14, 2021 7:13 AM
> *To:* General discussion list for the 389 Directory server project.
> <389-users(a)lists.fedoraproject.org>; Mark Reynolds
> <mreynolds(a)redhat.com>; Ghiurea, Isabella
> <Isabella.Ghiurea(a)nrc-cnrc.gc.ca>
> *Subject:* Re: [389-users] Re: global passwd policy for DS with
> existing users
>
> /***ATTENTION*** This email originated from outside of the NRC.
> ***ATTENTION*** Ce courriel provient de l'extérieur du CNRC/
>
> On 9/14/21 3:15 PM, Mark Reynolds wrote:
>
> On 9/10/21 5:14 PM, Ghiurea, Isabella wrote:
>
> 1.Thank you Mark,
>
> 2. I am considering the DS global password Policy with the
> configuration to have the users “must” change their passwords
> according to a schedule.
>
> If the schedule is fixed delay of validity of reset password, then you
> may have look a temporary password rules
> https://www.port389.org/docs/389ds/design/otp-password-policy.html
> <https://www.port389.org/docs/389ds/design/otp-password-policy.html>.
>
> regards
>
> 3.Since there are already 6K users in DS with no password
> policy in place I am thinking for start we shall force and
> update each uid userPassword attribute ( running a script in DS),
>
> 4.and next step configure the DS for global password policy
> with the new attributes in place ( which specific attributes
> you suggest?)
>
> That is up to you which policies you want to use.
>
> 5.and the last step when the users are trying to logging they
> must change their passw since their old passwd was removed
> already.
>
> If you remove their old password then they can not reset their
> password since they can not even log in. It would need to be done
> by a different entry/user. I do not recommend removing the
> userpassword attribute from your entries.
>
> If you want to force all your users to reset their passwords then
> you need to set "passwordMustChange" to "on", and set the
> passwordExpirationtime to "19700101000000Z". This will force
> users to have to reset their passwords /after/ they log in.
>
> 6. How is this design option sounds ?
>
> 7. I assume for the new passwd policy the following
> attributes will need to be configured : *passwordExp* - ,
> *passwordMaxAge* , *passwordWarning* ,*passwordMustChange*
> *passwordGracelimit* – is this correct ?
>
> If these are the settings you want, then yes. There is no single
> recommendation that fits everyone's needs.
>
> 8.
>
> 9. The two DSs are configured in multimaster replication and
> another DS acting as slave cfg in master to slave ( only
> reads accepted) , from what I read will need to configure
> each of the master DS with same Password Policy correct ?
>
> Correct
>
> Also see:
>
> https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
> <https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...>
>
> 10. How about the slave DS any configuration changes and
> which ones ?
>
> You need to set the password policies the same on /all/ servers,
> or else those servers will not enforce the password policies.
>
> HTH,
> Mark
>
> 11.Thank you
>
> 12.Isabella
>
> *From:*Mark Reynolds [mailto:mreynolds@redhat.com
> <mailto:mreynolds@redhat.com>]
> *Sent:* September 10, 2021 12:38 PM
> *To:* General discussion list for the 389 Directory server
> project. <389-users(a)lists.fedoraproject.org>
> <mailto:389-users@lists.fedoraproject.org>; Ghiurea, Isabella
> <Isabella.Ghiurea(a)nrc-cnrc.gc.ca>
> <mailto:Isabella.Ghiurea@nrc-cnrc.gc.ca>
> *Subject:* Re: [389-users] global passwd policy for DS with
> existing users
>
> /***ATTENTION*** This email originated from outside of the
> NRC. ***ATTENTION*** Ce courriel provient de l'extérieur du CNRC/
>
> On 9/10/21 1:46 PM, Ghiurea, Isabella wrote:
>
> Hi List,
>
> I need your expertise , I am looking to configure global
> password policy for an existing DS with aprox 7 k users,
> at present we are using only the userPassword attribute ,
> no extra password plugins or attributes are enabled ,
> the DS is running 1.3.7.5-24.el7_5.x86_64
>
> What is the less intrusive solution to implement a
> global Password Policy and cfg attributes for all
> existing user accounts without sending each user emails
> notification to reset their password ? I understand the
> Password Policy will take effect only after the users
> passwords are reset , is this correct ?
>
> Depends...
>
> You are not being specific about what password policy you want
> to implement, there are countless variations. Some require
> the password to be reset to start working, others do not. So
> please let us know exactly what you want to implement from
> password policy so we can answer your questions. For example
> there is password history, password expiration, password
> warning, grace periods, syntax checking, account lockout, etc.
> Each one has its own behavior and configuration.
>
> If you are not sure what you want to implement then I
> recommend looking over the admin guide to see more details on
> the password policy options:
>
> https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
> <https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...>
>
> HTH,
>
> Mark
>
>
>
>
> _______________________________________________
>
> 389-users mailing list --389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org>
>
> To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org <mailto:389-users-leave@lists.fedoraproject.org>
>
> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/>
>
> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines>
>
> List Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fe... <https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...>
>
> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure>
>
> --
>
> Directory Server Development Team
>
>
>
> _______________________________________________
>
> 389-users mailing list --389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org>
>
> To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org <mailto:389-users-leave@lists.fedoraproject.org>
>
> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/>
>
> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines>
>
> List Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fe... <https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...>
>
> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure>
>
> --
>
> Directory Server Development Team
>
>
>
> _______________________________________________
>
> 389-users mailing list --389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org>
>
> To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org <mailto:389-users-leave@lists.fedoraproject.org>
>
> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/>
>
> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines>
>
> List Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fe... <https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...>
>
> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure>
>
1 year, 4 months
global passwd policy for DS with existing users
by Ghiurea, Isabella
Hi List,
I need your expertise , I am looking to configure global password policy for an existing DS with aprox 7 k users, at present we are using only the userPassword attribute , no extra password plugins or attributes are enabled , the DS is running 1.3.7.5-24.el7_5.x86_64
What is the less intrusive solution to implement a global Password Policy and cfg attributes for all existing user accounts without sending each user emails notification to reset their password ? I understand the Password Policy will take effect only after the users passwords are reset , is this correct ?
Isabella
1 year, 4 months