Hi,
I'm installing an OpenLDAP directory server at a customer and we're also implementing password policies. We do have set the pwdMustChange attribute to true in our policy.
During the tests I was a bit surprised that a user for which I've set the password did not require to change his password but was allowed access with the new password.
Reading the documentation and the (expired) draft standard clearly suggests a different behavior.
pwdMustChange (true or false)
This attribute specifies with a value of "TRUE" that users must change their passwords when they first bind to the directory after a password is set or reset by a password administrator. If this attribute is not present, or if the value is "FALSE", users are not required to change their password upon binding after the password administrator sets or resets the password. This attribute is not set due to any actions specified by this document, it is typically set by a password administrator after resetting a user's password.
The question is: Why does an administrator need to set this attribute? Why isn't this done by the directory server on its own? The directory server does change a few other password policy related attributes as can be seen from the audit log (see below). Thus it should be possible to do the same for the pwdReset attribute.
This behavior of OpenLDAP is different from what I'm used from the Sun (now Oracle) Directory Server where the pwdReset attribute is changed automatically.
Best regards
Felix
# modify 1367849424 dc=telefonica,dc=com cn=Manager,dc=example,dc=com IP=192.168.186.141:52267 conn=1561
dn: uid=fbtwo,ou=people,dc=de,dc=telefonica,dc=com
changetype: modify
replace: userPassword
userPassword:: e1NTSEF9VzNpZmtPRkROQTk0MCtmR3pIanZOcTdxbk9QUDArNTM=
-
replace: pwdChangedTime
pwdChangedTime: 20130506141024Z
-
delete: pwdGraceUseTime
-
add: pwdHistory
pwdHistory: 20130506141024Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}AU4VVldD3ct
JnHil4AZPHnIC4G1aobhg
-
replace: entryCSN
entryCSN: 20130506141024.395155Z#000000#001#000000
-
replace: modifiersName
modifiersName: cn=Manager,dc=example,dc=com
-
replace: modifyTimestamp
modifyTimestamp: 20130506141024Z
-
# end modify 1367849424