Leonid Bogdanov wrote: > Ok, how can I add a new operational attribute to schema? I've tried several ways, but they didn't work. > What ways have you tried? > When I created a new class based on 'inetorgperson' (e.g., 'inetorgpersonex') I couldn't create object of this class or change class of existing object (user account) by means of Fedora admin console. > The usual way to do this is to create a new attribute, then create a new AUXILIARY objectclass with your new attribute as an allowed (MAY), not required (MUST), attribute. Then you should be able to add your objectclass to any existing entry, then add your attribute. > I've tried to configure password policy too. But with enabled option 'user must change password after reset' and when administrator change user's password user succefully logins with new password and there are no exceptions or warnings that he must change it. My program is using Novell JLDAP library, just in case. > The directory server adds two response controls to the bind request - the first one is the LDAP password expired control OID "2.16.840.1.113730.3.4.4" - the second one is the newer password policy response control OID "1.3.6.1.4.1.42.2.27.8.5.1" with the valid "password change after reset". The second is only returned if the client uses the password policy request control OID "1.3.6.1.4.1.42.2.27.8.5.1" with the bind request. The use of one or both of these controls should give your client information about the password. I would assume the JLDAP API allows you to send and receive LDAPv3 controls, and may even have support for these particular controls. > Thank you in advance! > > -----Original Message----- > From: Rich Megginson <rmeggins at redhat.com> > To: Leonid Bogdanov <leonid_bogdanov at mail.ru>, > "General discussion list for the 389 Directory server project." <fedora-directory-users at redhat.com> > Date: Thu, 16 Jul 2009 09:15:13 -0600 > Subject: Re: [389-users] Adding custom attribute to class > > >> Leonid Bogdanov wrote: >> >>> Hello! >>> >>> How can I add custom attribute to 'inetorgperson' class? Preferably without inheritance. >>> >> You should never add custom attributes to standard objectclasses such as >> inetOrgPerson. You should always extend the schema through inheritance >> (or create a new operational attribute if you must). >> >>> The problem is that I want to have boolean attribute which I can check in my program and tell user that he must change password after admin reset. Something like 'pwdReset' attribute in OpenLDAP. >>> >>> >> If you configure the password policy so that the user must change the >> password after a reset >> http://www.redhat.com/docs/manuals/dir-server/8.1/admin/User_Account_Management.html#User_Account_Management-Managing_the_Password_Policy >> >> Will that do what you want? You can also check the operational >> attribute passwordExpirationTime >> >>> Thank you! >>> >>> -- >>> 389 users mailing list >>> 389-users at redhat.com >>> https://www.redhat.com/mailman/listinfo/fedora-directory-users >>> >>> >> ATTACHMENT: application/x-pkcs7-signature (smime.p7s) >> >> > > -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3258 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20090717/3f6ff8eb/attachment.bin
