Re: Question about lastlogintime

[Mark Reynolds <mareynol@xxxxxxxxxx>]

Harry,

Check this out:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/account-policy-plugin.html#account-policy-plugin-wo-lockout

All you have to do is turn on the plugin, and add this entry to the config:

dn: cn=config,cn=Account Policy Plugin,cn=plugins,cn=config
objectClass: top
objectClass: extensibleObject
cn: config
alwaysrecordlogin: yes
stateattrname: lastLoginTime
altstateattrname: createTimestamp
specattrname: acctPolicySubentry
limitattrname: accountInactivityLimit

Then all future logins will automatically be recorded:

ldapsearch -D "uid=mark,dc=example,dc=com" -w password -b "dc=example,dc=com" -xLLL  uid=* lastlogintime
dn: uid=mark,dc=example,dc=com
lastlogintime: 20130726194751Z

Regards,
Mark

On 07/26/2013 03:35 PM, harry.devine@xxxxxxx wrote:

I looked them over but I'm still not clear on it.  I don't necessarily want to lock out accounts after a certain amount of time, I just want to record the last login time.  I guess I still don't see whether I need add that attribute to each user account, either manually or via some sort of script.

Thanks,
Harry

Harry Devine
Common ARTS Software Development
AJM-245
(609)485-4218
Harry.Devine@xxxxxxx

From:	Rich Megginson <rmeggins@xxxxxxxxxx>
To:	"General discussion list for the 389 Directory server project." <389-users@xxxxxxxxxxxxxxxxxxxxxxx>
Cc:	Harry Devine/ACT/FAA@FAA
Date:	07/26/2013 11:57 AM
Subject:	Re: Question about lastlogintime

---

On 07/26/2013 09:07 AM, harry.devine@xxxxxxx wrote:

We were interested in tracking a user's last login time, and I see the attribute that I can add in the user's profile.  But we have 460 users so adding that in manually would be tedious.  I saw this article online: https://fedorahosted.org/389/ticket/371 and wondered if all we had to do was add what it mentions to our dse.ldif file and restart the server.  

Yes, but see http://www.port389.org/wiki/Account_Policy_Design and https://fedorahosted.org/389/ticket/47439


Would that work?  If not, would scripting the addition of that attribute be possible?  Or is there another way?




Thanks!
Harry


--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users

--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users

-- 
Mark Reynolds
Red Hat, Inc
mreynolds@xxxxxxxxxx

--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users