Changes between Version 1 and Version 2 of ALL__security_passwd_policy
- Timestamp:
- 12/03/14 10:40:28 (10 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
ALL__security_passwd_policy
v1 v2 1 # 20081104 elm iPlanet Password Policies 1 = iPlanet Password Policies = 2 Original Author: Beth Mercer - 20081104 2 3 3 Note: Thoughout this document are references to ldap_*<Inst> commands. Those are 4 == Definitions == 5 Thoughout this document are references to ldap_*<Inst> commands. Those are 4 6 simply scripted invocations of the associated ldap* utilities that make it possible 5 7 to search the directory, and to add, modify and delete directory data using the … … 11 13 "policy" throughout this document. 12 14 13 iPlanet supports one default password policy at the config level. The default 15 == Default Password Policy == 16 iPlanet supports one default password policy at the /config level. The default 14 17 password policy dictates the behavior of any directory record not explicitly 15 18 associated with another, non-default password policy. … … 17 20 The settings for the default policy in all Enterprise Directory instances (test, 18 21 prep and production) are the same. They can be seen/modified via the iPlanet console 19 or they can be seen and updated by using command line utilities 22 or they can be seen and updated by using command line utilities. 20 23 24 === Query the LDAP Configuration for an Instance === 25 The following example queries PROD: 26 {{{ 21 27 iplanet@egegik> ldap_queryConfigProd "(cn=Password Policy)" 22 28 dn: cn=Password Policy,cn=config … … 43 49 passwordMinAge: 0 44 50 passwordRootdnMayBypassModsChecks: on 51 }}} 45 52 53 === Modify LDAP Password Policy for an Instance === 54 {{{ 46 55 iplanet@egegik> ldap_modifyProd "(cn=Password Policy)" 47 56 dn: cn=Password Policy,cn=config … … 49 58 replace: passwordMaxAge 50 59 passwordMaxAge: <some new value> 60 }}} 51 61 52 62 == Creating Additional Password Policies == 53 63 iPlanet supports creation of additional password policies but those policies must 54 64 be manually associated with a directory account much like any other piece of directory 55 65 data. Additional password policies can be created using ldapadd and associated with 56 individual directory records using ldapmodify.66 individual directory records using iPlanet ''ldapmodify'' command. The following three examples show how one might create a new policy that is associated with a directory. 57 67 68 === First Delete the Instance Default Password === 69 {{{ 58 70 iplanet@egegik> ldap_deleteTest 59 71 inst: test … … 70 82 deleting entry cn=Password Policy,ou=resource,dc=alaska,dc=edu 71 83 entry removed 84 }}} 72 85 86 === Create a New Password Policy for the Instance === 87 {{{ 73 88 iplanet@egegik> cat create_resource_password_policyTest.20070220 74 89 dn: cn=Password Policy,ou=resource,dc=alaska,dc=edu … … 93 108 passwordMaxFailure: 5 94 109 passwordLockoutDuration: 1800 95 110 }}} 111 === Add the Password Policy to the Instance === 112 {{{ 96 113 iplanet@egegik> ldap_addTest -f create_resource_password_policyTest.20070220 97 114 inst: test … … 145 162 adding new entry cn=Password Policy,ou=resource,dc=alaska,dc=edu 146 163 modify complete 164 }}} 147 165 166 === Modify a Resource Using a Script to Invoke iPlanet '''ldapmodify''' === 167 Once a password policy exists, modifying it is accomplished in the usual way. In the example below, the script, ldap_modifyTest does the invocation for the usual iPlanet ''ldapmodify'' command that can be run from the command line. 168 {{{ 148 169 iplanet@egegik> ldap_modifyTest 149 170 dn: uid=fake03,dc=resource,dc=alaska,dc=edu … … 152 173 passwordPolicySubentry: cn=Password Policy,ou=resource,dc=alaska,dc=edu 153 174 <ctrl+d> 175 }}} 154 176 155 177 Changes to max age impact only future password changes. If a password expiration … … 157 179 until the next time the password is changed. 158 180 159 Note:Work on an additional password policy that might someday be applied to181 ''Note:'' Work on an additional password policy that might someday be applied to 160 182 ou=resource records can be found on egegik under ~iplanet/local/ldap/schema/POLICY. 161 162 # eof
