On 02/28/2017 08:45 AM, Predrag Zečević - Technical Support Analyst wrote:
On 02/28/17 02:13 PM, Mark Reynolds wrote:
>
>
> On 02/28/2017 04:25 AM, Predrag Zečević - Technical Support Analyst
> wrote:
>> On 02/28/17 08:25 AM, tuan88(a)gmail.com wrote:
>>> h
>>>>> passwordHistory is not set in your policy config, thus it is not
>>>>> beingen forced:
>>> yes it is, i had set it the last many years
>>> pls see the screendump in my first thread
>>>
>>> Policy settings from GUI:
>>>
www.chezmoi.dk/389-passwd-not-expire.png
>>>
>>> bt Tuan
>>> _______________________________________________
>>> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
>>> To unsubscribe send an email to
>>> 389-users-leave(a)lists.fedoraproject.org
>>>
>>
>> Hi all,
>>
>> I can confirm that something is wrong, also in 389-ds-base-1.3.5.14
>> (e.g. also having same problem).
> Make sure you are NOT using Directory manager to change passwords.
> Directory manager bypasses password policies.
>>
Thanks, that might be a reason. I will make note and check scripts.
On a side note
- this is documented in the Administration guide.
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10...
This doc refers to the Directory Manager account as the root DN, which
is correct but could be confusing. This could be "clearer" so I've
opened a doc bug on this.
Regards,
Mark
With best regards.
Predrag Zečević
>> Some users are not forced to change password although it has been
>> expired upon rules of our PP, and that is purely random situation...
>> Moreover, I have not found anything which might cause it.
>>
>> What would be best way to debug that (considering that it does not
>> happen so often, so switching debug log to any of values from
>>
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8....
>>
>> could be not so useful)?
>>
>> With best regards.
>> Predrag Zečević
>>
> _______________________________________________
> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>