On 10/3/23 01:11, Mark Reynolds wrote:
On 10/2/23 4:13 AM, Cenk Y. wrote:
> Hi Mark, thanks for the response.
>
> We already use password lockout plugin, but what I need is the opposite.
>
> I want to
> * Create an account, activate it
> * Set an expiration date, so that after that date account is locked.
Hi Cenk,
I agree with Mark, password base expiration is likely not what you are
looking for (because of reset).
Before opening a RFE, you may check if the account policy plugin may
match you need
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11...
best regards
thierry
Yeah there is no way to "lock" an account that way. You
can set the
password to expire, but its not the same thing and a password reset
will bump that expiration time anyway.
Please file an RFE for this feature, but it could take some time until
it's implemented.
https://github.com/389ds/389-ds-base/issues/new
Thanks,
Mark
>
> Cheers
> Cenk
>
> On Fri, Sep 29, 2023 at 9:50 PM Mark Reynolds <mareynol(a)redhat.com>
> wrote:
>
> Actually, I was wrong there is more you need to do.
>
> You need to enable account lockout and set a max failure count:
>
> # dsconf slapd-INSTANCE config set passwordLockout=on
> passwordMaxFailure=3
>
> Then set in each user entry:
>
> passwordRetryCount: 3 --> number equal to passwordMaxFailure
>
> retryCountResetTime: 20230929193912Z --> you must
> calculate this
> value (and use it for these two attributes)
>
> accountUnlockTime: 20230929193912Z
>
>
> That works for me.
>
> HTH,
>
> Mark
>
>
> On 9/29/23 11:40 AM, Cenk Y. wrote:
> > Hello,
> >
> > We are running 389-ds-base.2.2.7 .
> >
> > While creating accounts, sometimes we know until when they need
> to be
> > active. Is there a way to manually set a "expiration date" for
the
> > account, so after that date nsAccount is set to true?
> >
> > Having gone through rhds and 389-ds pages, it seems it's only
> possible
> > to create a policy to deactivate accounts after an inactivity
> limit.
> >
> > I can always create a mechanism myself (such as adding a new
> attribute
> > and checking it by a cron job ...) , but I want to see if there
> is a
> > native way to do this?
> >
> > Thanks
> > Cenk
> >
> > _______________________________________________
> > 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> > To unsubscribe send an email to
> 389-users-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
>
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
>
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
> > Do not reply to spam, report it:
>
https://pagure.io/fedora-infrastructure/new_issue
>
> --
> Directory Server Development Team
>
--
Directory Server Development Team
_______________________________________________
389-users mailing list --389-users(a)lists.fedoraproject.org
To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org
Fedora Code of
Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List
Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
List
Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fe...
Do not reply to spam, report it:https://pagure.io/fedora-infrastructure/new_issue