On to, 14 maalis 2019, Jelle de Jong via FreeIPA-users wrote:
Hello everybody,
First thank you for the great software and this support list!
I got a few questions:
version that I am using: ipa-server-4.6.4-10.el7.centos.2.x86_64
1) I need to be able to set the initial password and not have it
changed or expired after I add the user. I need users to be able to
login straight away. What configuration file or policy option? And
where can I change this for all users?
See
https://www.freeipa.org/page/New_Passwords_Expired for explanation why it
is done this way and how this works.
An excellent third-party extension for FreeIPA that allows password resets to
be handled by users themselves is
https://github.com/larrabee/freeipa-password-reset
If you need to keep initial passwords for the users, you may want to
amend your procedure to create those passwords like described in this
email:
https://www.redhat.com/archives/freeipa-users/2012-June/msg00360.html
2) I want to change the default timeout for the OTP token, when
generated from the GUI? (I am aware about the option with the CLI)
According to
https://pagure.io/freeipa/issue/4402, ipatokentotptimestep is only
visible for TOTP token type because it makes no sense for HOTP.
This means that if you choose TOTP token, you'll see the time step field. For
CLI this will be the same -- for HOTP token type time step is ignored.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland