You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@directory.apache.org by "Pittman, Michael" <mp...@harris.com> on 2017/03/07 20:29:51 UTC

[ApacheDS] Disable account after period of inactivity

Hi,

I'm looking for a way to disable a user account if the user has not logged in for a configurable amount of days. Does ApacheDS currently support this?

If not, do you guys have any ideas for how to accomplish this goal?

Michael Pittman
Software Engineer
CRITICAL NETWORKS / HARRIS CORPORATION
Mobile: (863) 517-1910

Re: [ApacheDS] Disable account after period of inactivity

Posted by Emmanuel Lécharny <el...@gmail.com>.


Le 07/03/2017 à 21:29, Pittman, Michael a écrit :
> Hi,
>
> I'm looking for a way to disable a user account if the user has not logged in for a configurable amount of days. Does ApacheDS currently support this?

You would like to set a default passwordPolcy, and set the
ads-pwdMaxIdle attribute. From
https://tools.ietf.org/html/draft-behera-ldap-password-policy-10#page-27 :

5.2.20.  pwdMaxIdle

   This attribute specifies the number of seconds an account may remain
   unused before it becomes locked.  If this attribute is not set or is
   0, no check is performed.

         ( 1.3.6.1.4.1.42.2.27.8.1.26
         NAME 'pwdMaxIdle'
         EQUALITY integerMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
         SINGLE-VALUE )

Have a look at
http://directory.apache.org/apacheds/advanced-ug/4.3-password-policy.html

-- 
Emmanuel Lecharny

Symas.com
directory.apache.org