I have been attempting to use the ppolicy overlay on an openldap server running

on a Red Hat V5.4 platform with the following components:

openldap-servers-2.3.43-3.el5

checkpassword-ldap-0.01-1.2.el5.rf

mozldap-6.0.5-1.el5

openldap-2.3.43-3.el5

openldap-debuginfo-2.3.43-3.el5

nss_ldap-253-22.el5_4

openldap-clients-2.3.43-3.el5

openldap-servers-overlays-2.3.43-3.el5

I was unable to get the users password to expire by simply setting  a value for

pwdMaxAge without the use of the pwdReset parameter.     

I finally turned on all debugging in the slapd.conf file (value -1) and noticed that

the value of pwdGraceAuthNLimit in the default policy,  was set to 3, which allowed

the ldap user access without changing the password.

The disturbing thing about this was the fact that the user is not notifed that their

password has expired.   I would have thought that if the intent was to allow an

expired password, then the user should be notified of not only the fact that their

password has expired but how many more grace logins they would be allowed

before either having to change the password or having the account disabled.

Is this really what development had intended or are there some enhancements

to this behavior in a later version ?

Thanks,

Al Licause

HP Services

Unix Network Team