On 02/28/2017 08:45 AM, Predrag Zečević - Technical Support Analyst wrote: > On 02/28/17 02:13 PM, Mark Reynolds wrote: >> >> >> On 02/28/2017 04:25 AM, Predrag Zečević - Technical Support Analyst >> wrote: >>> On 02/28/17 08:25 AM, tuan88@xxxxxxxxx wrote: >>>> h >>>>>> passwordHistory is not set in your policy config, thus it is not >>>>>> beingen forced: >>>> yes it is, i had set it the last many years >>>> pls see the screendump in my first thread >>>> >>>> Policy settings from GUI: >>>> www.chezmoi.dk/389-passwd-not-expire.png >>>> >>>> bt Tuan >>>> _______________________________________________ >>>> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx >>>> To unsubscribe send an email to >>>> 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx >>>> >>> >>> Hi all, >>> >>> I can confirm that something is wrong, also in 389-ds-base-1.3.5.14 >>> (e.g. also having same problem). >> Make sure you are NOT using Directory manager to change passwords. >> Directory manager bypasses password policies. >>> > Thanks, that might be a reason. I will make note and check scripts. On a side note - this is documented in the Administration guide. https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10/html/Administration_Guide/User_Account_Management.html#Managing_the_Password_Policy-Setting_User_Passwords This doc refers to the Directory Manager account as the root DN, which is correct but could be confusing. This could be "clearer" so I've opened a doc bug on this. Regards, Mark > > With best regards. > Predrag Zečević > >>> Some users are not forced to change password although it has been >>> expired upon rules of our PP, and that is purely random situation... >>> Moreover, I have not found anything which might cause it. >>> >>> What would be best way to debug that (considering that it does not >>> happen so often, so switching debug log to any of values from >>> https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/html/Configuration_and_Command-Line_Tool_Reference/error-logs.html >>> >>> could be not so useful)? >>> >>> With best regards. >>> Predrag Zečević >>> >> _______________________________________________ >> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx >> To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx >> > _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
