Justin Crawford wrote: >> Justin Crawford wrote: >> >>> Is "passwordRetryCount" replicated in a multimaster setup? >>> >> Or, when >> >>> replication copies a "userPassword" change, is "passwordRetryCount" >>> reset to 0 in the consumer, by the consumer? >>> >>> I just helped a user whose retry count was 0 on one of our >>> >> replicated >> >>> LDAPs, but stuck at maximum on the other, *after* multiple password >>> changes. I didn't think that would be possible! >>> >>> >> Are these read-only replicas or masters? >> > > These are both masters in a multimaster setup. Changing the password on > ldap1 changes the password and passwordExpirationTime on ldap2. But > passwordRetryCount on ldap2 remains unchanged. I've usually seen > passwordRetryCount reset to 0 when userPassword changes, no matter how > the password change occurs. Is it different with multimaster > replication? > Yes. You have to enable global password policy. By default, password policy is local to each host. You have to enable global password policy to replicate the password policy op attrs. In the entry cn=config, set the attribute passwordisglobalpolicy to the value "on". > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3178 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20061106/0456469c/attachment.bin
