Re: Tips when implementing password policies

Chris Jacobs wrote:

I've a few accounts that I was testing with - after I set the password

/after/ ppolicy was in place, things work as expected. Password history, # grace auths, etc.

However, for those accounts existing before the ppolicy was in place, no

enforcement - there's no password change date set, nor any other policy items added - other than the pwdpolicysubentry.

Please read the slapo-ppolicy(5) manpage. In particular, read the description of the pwdChangedTime attribute.

One note: early on in the old ldap installations use, inetorgperson wasn't a

class on accounts. Is that necessary for pwdpolicy? Would that make everything else work for the legacy accounts?

I'll send an example LDIF of a test account and a legacy account later.

• chris