Leonid Bogdanov wrote:
Ok, how can I add a new operational attribute to schema? I've
tried several ways, but they didn't work.
What ways have you tried?
When I created a new class based on 'inetorgperson' (e.g.,
'inetorgpersonex') I couldn't create object of this class or change class of
existing object (user account) by means of Fedora admin console.
The usual way to do this is to create a new attribute, then create a new
AUXILIARY objectclass with your new attribute as an allowed (MAY), not
required (MUST), attribute. Then you should be able to add your
objectclass to any existing entry, then add your attribute.
I've tried to configure password policy too. But with enabled
option 'user must change password after reset' and when administrator change
user's password user succefully logins with new password and there are no exceptions
or warnings that he must change it. My program is using Novell JLDAP library, just in
The directory server adds two response controls to the bind request -
the first one is the LDAP password expired control OID
"2.16.840.1.1137188.8.131.52" - the second one is the newer password policy
response control OID "184.108.40.206.220.127.116.11.18.104.22.168" with the valid
"password change after reset". The second is only returned if the
client uses the password policy request control OID
"22.214.171.124.126.96.36.199.188.8.131.52" with the bind request. The use of one or
both of these controls should give your client information about the
password. I would assume the JLDAP API allows you to send and receive
LDAPv3 controls, and may even have support for these particular controls.
Thank you in advance!
From: Rich Megginson <rmeggins(a)redhat.com>
To: Leonid Bogdanov <leonid_bogdanov(a)mail.ru>,
"General discussion list for the 389 Directory server project."
Date: Thu, 16 Jul 2009 09:15:13 -0600
Subject: Re: [389-users] Adding custom attribute to class
> Leonid Bogdanov wrote:
>> How can I add custom attribute to 'inetorgperson' class? Preferably
> You should never add custom attributes to standard objectclasses such as
> inetOrgPerson. You should always extend the schema through inheritance
> (or create a new operational attribute if you must).
>> The problem is that I want to have boolean attribute which I can check in my
program and tell user that he must change password after admin reset. Something like
'pwdReset' attribute in OpenLDAP.
> If you configure the password policy so that the user must change the
> password after a reset
> Will that do what you want? You can also check the operational
> attribute passwordExpirationTime
>> Thank you!
>> 389 users mailing list
> ATTACHMENT: application/x-pkcs7-signature (smime.p7s)