| blob | 2d9b06f908a128f98a0feed2d51f8ff6ceee0839 |
1 .\" $OpenLDAP: pkg/ldap/doc/man/man5/slapo-ppolicy.5,v 1.12.2.7 2008/04/24 08:15:34 hyc Exp $
2 .\" Copyright 2004-2008 The OpenLDAP Foundation All Rights Reserved.
3 .\" Copying restrictions apply. See COPYRIGHT/LICENSE.
4 .TH SLAPO_PPOLICY 5 "2008/07/16" "OpenLDAP 2.4.11"
5 .SH NAME
6 slapo-ppolicy \- Password Policy overlay to slapd
7 .SH SYNOPSIS
8 /etc/openldap/slapd.conf
9 .SH DESCRIPTION
10 .LP
11 The
12 .B ppolicy
13 overlay
14 is an implementation of the most recent IETF Password
15 Policy proposal for LDAP. When instantiated, it intercepts,
16 decodes and applies specific password policy controls to overall
17 use of a backend database, changes to user password fields, etc.
18 .P
19 The overlay provides a variety of password control mechanisms. They
20 include password aging--both minimum and maximum ages, password
21 reuse and duplication control, account time-outs, mandatory password
22 resets, acceptable password content, and even grace logins.
23 Different groups of users may be associated with different password
24 policies, and there is no limit to the number of password policies
25 that may be created.
26 .P
27 Note that some of the policies do not take effect when the operation
28 is performed with the
29 .B rootdn
30 identity; all the operations, when performed with any other identity,
31 may be subjected to constraints, like access control.
32 .P
33 Note that the IETF Password Policy proposal for LDAP makes sense
34 when considering a single-valued password attribute, while
35 the userPassword attribute allows multiple values. This implementation
36 enforces a single value for the userPassword attribute, despite
37 its specification.
39 .SH CONFIGURATION
40 These
41 .B slapd.conf
42 configuration options apply to the ppolicy overlay. They should appear
43 after the
44 .B overlay
45 directive.
46 .TP
47 .B ppolicy_default <policyDN>
48 Specify the DN of the pwdPolicy object to use when no specific policy is
49 set on a given user's entry. If there is no specific policy for an entry
50 and no default is given, then no policies will be enforced.
51 .TP
52 .B ppolicy_hash_cleartext
53 Specify that cleartext passwords present in Add and Modify requests should
54 be hashed before being stored in the database. This violates the X.500/LDAP
55 information model, but may be needed to compensate for LDAP clients that
56 don't use the Password Modify extended operation to manage passwords. It
57 is recommended that when this option is used that compare, search, and
58 read access be denied to all directory users.
59 .TP
60 .B ppolicy_use_lockout
61 A client will always receive an LDAP
62 .B InvalidCredentials
63 response when
64 Binding to a locked account. By default, when a Password Policy control
65 was provided on the Bind request, a Password Policy response will be
66 included with no special error code set. This option changes the
67 Password Policy response to include the
68 .B AccountLocked
69 error code. Note
70 that sending the
71 .B AccountLocked
72 error code provides useful information
73 to an attacker; sites that are sensitive to security issues should not
74 enable this option.
76 .SH OBJECT CLASS
77 The
78 .B ppolicy
79 overlay depends on the
80 .B pwdPolicy
81 object class. The definition of that class is as follows:
82 .LP
83 .RS 4
84 ( 1.3.6.1.4.1.42.2.27.8.2.1
85 NAME 'pwdPolicy'
86 AUXILIARY
87 SUP top
88 MUST ( pwdAttribute )
89 MAY (
90 pwdMinAge $ pwdMaxAge $ pwdInHistory $
91 pwdCheckQuality $ pwdMinLength $
92 pwdExpireWarning $ pwdGraceAuthnLimit $
93 pwdLockout $ pwdLockoutDuration $
94 pwdMaxFailure $ pwdFailureCountInterval $
95 pwdMustChange $ pwdAllowUserChange $
96 pwdSafeModify ) )
97 .RE
99 This implementation also provides an additional
100 .B pwdPolicyChecker
101 objectclass, used for password quality checking (see below).
102 .LP
103 .RS 4
104 ( 1.3.6.1.4.1.4754.2.99.1
105 NAME 'pwdPolicyChecker'
106 AUXILIARY
107 SUP top
108 MAY ( pwdCheckModule ) )
109 .RE
110 .P
111 Every account that should be subject to password policy control should
112 have a
113 .B
114 pwdPolicySubentry
115 attribute containing the DN of a valid
116 .B pwdPolicy
117 entry, or they can simply use the configured default.
118 In this way different users may be managed according to
119 different policies.
121 .SH OBJECT CLASS ATTRIBUTES
122 .P
123 Each one of the sections below details the meaning and use of a particular
124 attribute of this
125 .B pwdPolicy
126 object class.
127 .P
129 .B pwdAttribute
130 .P
131 This attribute contains the name of the attribute to which the password
132 policy is applied. For example, the password policy may be applied
133 to the
134 .B userPassword
135 attribute.
136 .P
137 Note: in this implementation, the only
138 value accepted for
139 .B pwdAttribute
140 is
141 .IR " userPassword ".
142 .LP
143 .RS 4
144 ( 1.3.6.1.4.1.42.2.27.8.1.1
145 NAME 'pwdAttribute'
146 EQUALITY objectIdentifierMatch
147 SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
148 .RE
150 .B pwdMinAge
151 .P
152 This attribute contains the number of seconds that must elapse
153 between modifications allowed to the password. If this attribute
154 is not present, zero seconds is assumed (i.e. the password may be
155 modified whenever and however often is desired).
156 .LP
157 .RS 4
158 ( 1.3.6.1.4.1.42.2.27.8.1.2
159 NAME 'pwdMinAge'
160 EQUALITY integerMatch
161 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
162 SINGLE-VALUE )
163 .RE
165 .B pwdMaxAge
166 .P
167 This attribute contains the number of seconds after which a modified
168 password will expire. If this attribute is not present, or if its
169 value is zero (0), then passwords will not expire.
170 .LP
171 .RS 4
172 ( 1.3.6.1.4.1.42.2.27.8.1.3
173 NAME 'pwdMaxAge'
174 EQUALITY integerMatch
175 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
176 SINGLE-VALUE )
177 .RE
179 .B pwdInHistory
180 .P
181 This attribute is used to specify the maximum number of used
182 passwords that will be stored in the
183 .B pwdHistory
184 attribute. If the
185 .B pwdInHistory
186 attribute is not present, or if its value is
187 zero (0), used passwords will not be stored in
188 .B pwdHistory
189 and thus any previously-used password may be reused.
190 No history checking occurs if the password is being modified by the
191 .BR rootdn ,
192 although the password is saved in the history.
193 .LP
194 .RS 4
195 ( 1.3.6.1.4.1.42.2.27.8.1.4
196 NAME 'pwdInHistory'
197 EQUALITY integerMatch
198 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
199 SINGLE-VALUE )
200 .RE
202 .B pwdCheckQuality
203 .P
204 This attribute indicates if and how password syntax will be checked
205 while a password is being modified or added. If this attribute is
206 not present, or its value is zero (0), no syntax checking will be
207 done. If its value is one (1), the server will check the syntax,
208 and if the server is unable to check the syntax,
209 whether due to a client-side hashed password or some other reason,
210 it will be
211 accepted. If its value is two (2), the server will check the syntax,
212 and if the server is unable to check the syntax it will return an
213 error refusing the password.
214 .LP
215 .RS 4
216 ( 1.3.6.1.4.1.42.2.27.8.1.5
217 NAME 'pwdCheckQuality'
218 EQUALITY integerMatch
219 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
220 SINGLE-VALUE )
221 .RE
223 .B pwdMinLength
224 .P
225 When syntax checking is enabled
226 (see also the
227 .B pwdCheckQuality
228 attribute), this attribute contains the minimum
229 number of characters that will be accepted in a password. If this
230 attribute is not present, minimum password length is not
231 enforced. If the server is unable to check the length of the password,
232 whether due to a client-side hashed password or some other reason,
233 the server will, depending on the
234 value of
235 .BR pwdCheckQuality ,
236 either accept the password
237 without checking it (if
238 .B pwdCheckQuality
239 is zero (0) or one (1)) or refuse it (if
240 .B pwdCheckQuality
241 is two (2)).
242 .LP
243 .RS 4
244 ( 1.3.6.1.4.1.42.2.27.8.1.6
245 NAME 'pwdMinLength'
246 EQUALITY integerMatch
247 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
248 SINGLE-VALUE )
249 .RE
251 .B pwdExpireWarning
252 .P
253 This attribute contains the maximum number of seconds before a
254 password is due to expire that expiration warning messages will be
255 returned to a user who is authenticating to the directory.
256 If this attribute is not
257 present, or if the value is zero (0), no warnings will be sent.
258 .LP
259 .RS 4
260 ( 1.3.6.1.4.1.42.2.27.8.1.7
261 NAME 'pwdExpireWarning'
262 EQUALITY integerMatch
263 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
264 SINGLE-VALUE )
265 .RE
267 .B pwdGraceAuthnLimit
268 .P
269 This attribute contains the number of times that an expired password
270 may be used to authenticate a user to the directory. If this
271 attribute is not present or if its value is zero (0), users with
272 expired passwords will not be allowed to authenticate to the
273 directory.
274 .LP
275 .RS 4
276 ( 1.3.6.1.4.1.42.2.27.8.1.8
277 NAME 'pwdGraceAuthnLimit'
278 EQUALITY integerMatch
279 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
280 SINGLE-VALUE )
281 .RE
283 .B pwdLockout
284 .P
285 This attribute specifies the action that should be taken
286 by the directory when a user has made a number of failed attempts
287 to authenticate to the directory. If
288 .B pwdLockout
289 is set (its value is "TRUE"), the user will not be allowed to
290 attempt to authenticate to the directory after there have been a
291 specified number of consecutive failed bind attempts. The maximum
292 number of consecutive failed bind attempts allowed is specified by
293 the
294 .B pwdMaxFailure
295 attribute. If
296 .B pwdLockout
297 is not present, or if its value is "FALSE", the password may be
298 used to authenticate no matter how many consecutive failed bind
299 attempts have been made.
300 .LP
301 .RS 4
302 ( 1.3.6.1.4.1.42.2.27.8.1.9
303 NAME 'pwdLockout'
304 EQUALITY booleanMatch
305 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
306 SINGLE-VALUE )
307 .RE
309 .B pwdLockoutDuration
310 .P
311 This attribute contains the number of seconds during
312 which the password cannot be used to authenticate the
313 user to the directory due to too many consecutive failed
314 bind attempts.
315 (See also
316 .B pwdLockout
317 and
318 .BR pwdMaxFailure .)
319 If
320 .B pwdLockoutDuration
321 is not present, or if its value is zero (0), the password
322 cannot be used to authenticate the user to the directory
323 again until it is reset by an administrator.
324 .LP
325 .RS 4
326 ( 1.3.6.1.4.1.42.2.27.8.1.10
327 NAME 'pwdLockoutDuration'
328 EQUALITY integerMatch
329 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
330 SINGLE-VALUE )
331 .RE
333 .B pwdMaxFailure
334 .P
335 This attribute contains the number of consecutive failed bind
336 attempts after which the password may not be used to authenticate
337 a user to the directory.
338 If
339 .B pwdMaxFailure
340 is not present, or its value is zero (0), then a user will
341 be allowed to continue to attempt to authenticate to
342 the directory, no matter how many consecutive failed
343 bind attempts have occurred with that user's DN.
344 (See also
345 .B pwdLockout
346 and
347 .BR pwdLockoutDuration .)
348 .LP
349 .RS 4
350 ( 1.3.6.1.4.1.42.2.27.8.1.11
351 NAME 'pwdMaxFailure'
352 EQUALITY integerMatch
353 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
354 SINGLE-VALUE )
355 .RE
357 .B pwdFailureCountInterval
358 .P
359 This attribute contains the number of seconds after which old
360 consecutive failed bind attempts are purged from the failure counter,
361 even though no successful authentication has occurred.
362 If
363 .B pwdFailureCountInterval
364 is not present, or its value is zero (0), the failure
365 counter will only be reset by a successful authentication.
366 .LP
367 .RS 4
368 ( 1.3.6.1.4.1.42.2.27.8.1.12
369 NAME 'pwdFailureCountInterval'
370 EQUALITY integerMatch
371 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
372 SINGLE-VALUE )
373 .RE
375 .B pwdMustChange
376 .P
377 This attribute specifies whether users must change their passwords
378 when they first bind to the directory after a password is set or
379 reset by the administrator, or not. If
380 .B pwdMustChange
381 has a value of "TRUE", users must change their passwords when they
382 first bind to the directory after a password is set or reset by
383 the administrator. If
384 .B pwdMustChange
385 is not present, or its value is "FALSE",
386 users are not required to change their password upon binding after
387 the administrator sets or resets the password.
388 .LP
389 .RS 4
390 ( 1.3.6.1.4.1.42.2.27.8.1.13
391 NAME 'pwdMustChange'
392 EQUALITY booleanMatch
393 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
394 SINGLE-VALUE )
395 .RE
397 .B pwdAllowUserChange
398 .P
399 This attribute specifies whether users are allowed to change their own
400 passwords or not. If
401 .B pwdAllowUserChange
402 is set to "TRUE", or if the attribute is not present, users will be
403 allowed to change their own passwords. If its value is "FALSE",
404 users will not be allowed to change their own passwords.
405 .LP
406 .RS 4
407 ( 1.3.6.1.4.1.42.2.27.8.1.14
408 NAME 'pwdAllowUserChange'
409 EQUALITY booleanMatch
410 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
411 SINGLE-VALUE )
412 .RE
414 .B pwdSafeModify
415 .P
416 This attribute denotes whether the user's existing password must be sent
417 along with their new password when changing a password. If
418 .B pwdSafeModify
419 is set to "TRUE", the existing password must be sent
420 along with the new password. If the attribute is not present, or
421 its value is "FALSE", the existing password need not be sent
422 along with the new password.
423 .LP
424 .RS 4
425 ( 1.3.6.1.4.1.42.2.27.8.1.15
426 NAME 'pwdSafeModify'
427 EQUALITY booleanMatch
428 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
429 SINGLE-VALUE )
430 .RE
432 .B pwdCheckModule
433 .P
434 This attribute names a user-defined loadable module that must
435 instantiate the check_password() function. This function
436 will be called to further check a new password if
437 .B pwdCheckQuality
438 is set to one (1) or two (2),
439 after all of the built-in password compliance checks have
440 been passed. This function will be called according to this
441 function prototype:
442 .RS 4
443 int
444 .I check_password
445 (char *pPasswd, char **ppErrStr, Entry *pEntry);
446 .RE
447 The
448 .B pPasswd
449 parameter contains the clear-text user password, the
450 .B ppErrStr
451 parameter contains a double pointer that allows the function
452 to return human-readable details about any error it encounters.
453 The optional
454 .B pEntry
455 parameter, if non-NULL, carries a pointer to the
456 entry whose password is being checked.
457 If
458 .B ppErrStr
459 is NULL, then
460 .I funcName
461 must NOT attempt to use it/them.
462 A return value of LDAP_SUCCESS from the called
463 function indicates that the password is ok, any other value
464 indicates that the password is unacceptable. If the password is
465 unacceptable, the server will return an error to the client, and
466 .B ppErrStr
467 may be used to return a human-readable textual explanation of the
468 error. The error string must be dynamically allocated as it will
469 be free()'d by slapd.
470 .LP
471 .RS 4
472 ( 1.3.6.1.4.1.4754.1.99.1
473 NAME 'pwdCheckModule'
474 EQUALITY caseExactIA5Match
475 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
476 SINGLE-VALUE )
477 .RE
478 .P
479 Note:
480 The user-defined loadable module named by
481 .B pwdCheckModule
482 must be in
483 .B slapd's
484 standard executable search PATH.
485 .P
486 Note:
487 .B pwdCheckModule
488 is a non-standard extension to the LDAP password
489 policy proposal.
491 .SH OPERATIONAL ATTRIBUTES
492 .P
493 The operational attributes used by the
494 .B ppolicy
495 module are stored in the user's entry. Most of these attributes
496 are not intended to be changed directly by users; they are there
497 to track user activity. They have been detailed here so that
498 administrators and users can both understand the workings of
499 the
500 .B ppolicy
501 module.
503 .P
504 Note that the current IETF Password Policy proposal does not define
505 how these operational attributes are expected to behave in a
506 replication environment. In general, authentication attempts on
507 a slave server only affect the copy of the operational attributes
508 on that slave and will not affect any attributes for
509 a user's entry on the master server. Operational attribute changes
510 resulting from authentication attempts on a master server
511 will usually replicate to the slaves (and also overwrite
512 any changes that originated on the slave).
513 These behaviors are not guaranteed and are subject to change
514 when a formal specification emerges.
516 .B userPassword
517 .P
518 The
519 .B userPassword
520 attribute is not strictly part of the
521 .B ppolicy
522 module. It is, however, the attribute that is tracked and controlled
523 by the module. Please refer to the standard OpenLDAP schema for
524 its definition.
526 .B pwdPolicySubentry
527 .P
528 This attribute refers directly to the
529 .B pwdPolicy
530 subentry that is to be used for this particular directory user.
531 If
532 .B pwdPolicySubentry
533 exists, it must contain the DN of a valid
534 .B pwdPolicy
535 object. If it does not exist, the
536 .B ppolicy
537 module will enforce the default password policy rules on the
538 user associated with this authenticating DN. If there is no
539 default, or the referenced subentry does not exist, then no
540 policy rules will be enforced.
541 .LP
542 .RS 4
543 ( 1.3.6.1.4.1.42.2.27.8.1.23
544 NAME 'pwdPolicySubentry'
545 DESC 'The pwdPolicy subentry in effect for
546 this object'
547 EQUALITY distinguishedNameMatch
548 SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
549 SINGLE-VALUE
550 NO-USER-MODIFICATION
551 USAGE directoryOperation)
552 .RE
554 .B pwdChangedTime
555 .P
556 This attribute denotes the last time that the entry's password was
557 changed. This value is used by the password expiration policy to
558 determine whether the password is too old to be allowed to be used
559 for user authentication. If
560 .B pwdChangedTime
561 does not exist, the user's password will not expire.
562 .LP
563 .RS 4
564 ( 1.3.6.1.4.1.42.2.27.8.1.16
565 NAME 'pwdChangedTime'
566 DESC 'The time the password was last changed'
567 SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
568 EQUALITY generalizedTimeMatch
569 ORDERING generalizedTimeOrderingMatch
570 SINGLE-VALUE
571 NO-USER-MODIFICATION
572 USAGE directoryOperation)
573 .RE
575 .B pwdAccountLockedTime
576 .P
577 This attribute contains the time that the user's account was locked.
578 If the account has been locked, the password may no longer be used to
579 authenticate the user to the directory. If
580 .B pwdAccountLockedTime
581 is set to 000001010000Z, the user's account has been permanently locked
582 and may only be unlocked by an administrator.
583 .LP
584 .RS 4
585 ( 1.3.6.1.4.1.42.2.27.8.1.17
586 NAME 'pwdAccountLockedTime'
587 DESC 'The time an user account was locked'
588 SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
589 EQUALITY generalizedTimeMatch
590 ORDERING generalizedTimeOrderingMatch
591 SINGLE-VALUE
592 NO-USER-MODIFICATION
593 USAGE directoryOperation)
594 .RE
596 .B pwdFailureTime
597 .P
598 This attribute contains the timestamps of each of the consecutive
599 authentication failures made upon attempted authentication to this
600 DN (i.e. account). If too many timestamps accumulate here (refer to
601 the
602 .B pwdMaxFailure
603 password policy attribute for details),
604 and the
605 .B pwdLockout
606 password policy attribute is set to "TRUE", the
607 account may be locked.
608 (Please also refer to the
609 .B pwdLockout
610 password policy attribute.)
611 Excess timestamps beyond those allowed by
612 .B pwdMaxFailure
613 may also be purged. If a successful authentication is made to this
614 DN (i.e. to this user account), then
615 .B pwdFailureTime
616 will be cleansed of entries.
617 .LP
618 .RS 4
619 ( 1.3.6.1.4.1.42.2.27.8.1.19
620 NAME 'pwdFailureTime'
621 DESC 'The timestamps of the last consecutive
622 authentication failures'
623 SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
624 EQUALITY generalizedTimeMatch
625 ORDERING generalizedTimeOrderingMatch
626 NO-USER-MODIFICATION
627 USAGE directoryOperation )
628 .RE
630 .B pwdHistory
631 .P
632 This attribute contains the history of previously used passwords
633 for this DN (i.e. for this user account).
634 The values of this attribute are stored in string format as follows:
636 .RS 4
638 pwdHistory=
639 .RS 4
640 time "#" syntaxOID "#" length "#" data
641 .RE
643 time=
644 .RS 4
645 GeneralizedTime as specified in section 3.3.13 of [RFC4517]
646 .RE
648 .P
649 syntaxOID = numericoid
650 .RS 4
651 This is the string representation of the dotted-decimal OID that
652 defines the syntax used to store the password. numericoid is
653 described in section 1.4 of [RFC4512].
654 .RE
656 length = NumericString
657 .RS 4
658 The number of octets in the data. NumericString is described in
659 section 3.3.23 of [RFC4517].
660 .RE
662 data =
663 .RS 4
664 Octets representing the password in the format specified by syntaxOID.
665 .RE
667 .RE
669 This format allows the server to store and transmit a history of
670 passwords that have been used. In order for equality matching
671 on the values in this attribute to function properly, the time
672 field is in GMT format.
673 .LP
674 .RS 4
675 ( 1.3.6.1.4.1.42.2.27.8.1.20
676 NAME 'pwdHistory'
677 DESC 'The history of user passwords'
678 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
679 EQUALITY octetStringMatch
680 NO-USER-MODIFICATION
681 USAGE directoryOperation)
682 .RE
684 .B pwdGraceUseTime
685 This attribute contains the list of timestamps of logins made after
686 the user password in the DN has expired. These post-expiration
687 logins are known as "\fIgrace logins\fP".
688 If too many
689 .I grace logins
690 have been used (please refer to the
691 .B pwdGraceLoginLimit
692 password policy attribute), then the DN will no longer be allowed
693 to be used to authenticate the user to the directory until the
694 administrator changes the DN's
695 .B userPassword
696 attribute.
697 .LP
698 .RS 4
699 ( 1.3.6.1.4.1.42.2.27.8.1.21
700 NAME 'pwdGraceUseTime'
701 DESC 'The timestamps of the grace login once the password has expired'
702 SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
703 EQUALITY generalizedTimeMatch
704 NO-USER-MODIFICATION
705 USAGE directoryOperation)
706 .RE
708 .B pwdReset
709 .P
710 This attribute indicates whether the user's password has been reset
711 by the administrator and thus must be changed upon first use of this
712 DN for authentication to the directory. If
713 .B pwdReset
714 is set to "TRUE", then the password was reset and the user must change
715 it upon first authentication. If the attribute does not exist, or
716 is set to "FALSE", the user need not change their password due to
717 administrative reset.
718 .LP
719 .RS 4
720 ( 1.3.6.1.4.1.42.2.27.8.1.22
721 NAME 'pwdReset'
722 DESC 'The indication that the password has
723 been reset'
724 EQUALITY booleanMatch
725 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
726 SINGLE-VALUE
727 USAGE directoryOperation)
728 .RE
730 .SH EXAMPLES
731 .LP
732 .RS
733 .nf
734 database bdb
735 suffix dc=example,dc=com
736 \...
737 overlay ppolicy
738 ppolicy_default "cn=Standard,ou=Policies,dc=example,dc=com"
739 .fi
740 .RE
742 .SH SEE ALSO
743 .BR ldap (3),
744 .BR slapd.conf (5),
745 .LP
746 "OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)
747 .LP
748 IETF LDAP password policy proposal by P. Behera, L. Poitou and J.
749 Sermersheim: documented in IETF document
750 "draft-behera-ldap-password-policy-09.txt".
752 .SH BUGS
753 The LDAP Password Policy specification is not yet an approved standard,
754 and it is still evolving. This code will continue to be in flux until the
755 specification is finalized.
757 .SH ACKNOWLEDGEMENTS
758 .P
759 This module was written in 2004 by Howard Chu of Symas Corporation
760 with significant input from Neil Dunbar and Kartik Subbarao of Hewlett-Packard.
761 .P
762 This manual page borrows heavily and shamelessly from the specification
763 upon which the password policy module it describes is based. This
764 source is the
765 IETF LDAP password policy proposal by P. Behera, L.
766 Poitou and J. Sermersheim.
767 The proposal is fully documented in
768 the
769 IETF document named draft-behera-ldap-password-policy-09.txt,
770 written in July of 2005.
771 .P
772 .\" Shared Project Acknowledgement Text
773 .B "OpenLDAP Software"
774 is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>.
775 .B "OpenLDAP Software"
776 is derived from University of Michigan LDAP 3.3 Release.