Aaron Hagopian wrote: > I am having an issue in regards to handling expiring passwords during > the grace period. I also filed a bug because I find the behavior to > not be as expected > (https://bugzilla.redhat.com/show_bug.cgi?id=576303). But to > summarize my bug report, in my code that checks a user's credentials > (username / password) I ask the server for > the response controls (using Java/JNDI). When the user's pass hasn't > expired yet but they are in the warning period, in the response > I receive 2.16.840.1.113730.3.4.5 indicating the password is expiring, > which works great. > > Then when their password actually expires and they still haven't > changed it yet (Glass half full, they just haven't logged in during > that time and didn't ignore my warnings) and I have say 3 grace logins > allows in the policy the server doesn't respond with the warning > (2.16.840.1.113730.3.4.5) or the password expired response control > (2.16.840.1.113730.3.4.4). > > The only way I can determine during the grace period that the password > is actually expired and I'm on my grace login seems to be by checking > the passwordExpiredTime attribute by hand. This just seems silly to > me since the server knows the password expired and it knows to > increment the passwordGraceUserTime attribute for each successful > login after the password expired. I would think the server would > respond with both 2.16.840.1.113730.3.4.5 and 2.16.840.1.113730.3.4.4 > like it does when your password is reset by the administrator. > > Am I missing something? Anyone else have a cleaner way > of determining that it's a grace period login? I think it should return the pwexpired control. But according to this http://tools.ietf.org/html/draft-behera-ldap-password-policy-10#section-7.4 you should be able to determine how many grace logins are remaining? > By the way, for the record I'm accessing this in Java, not sure it > matters and here's a little code blurb: > > LdapContext ctx = new InitialLdapContext(env, nul); > Control[] ctls = ctx.getResponseControls(); > if(ctls != null) { > for(Control control : ctls) { > System.out.println(control.getID()); > } > } > > Also if this question should be on the devel list I apologize but I > figured that was for actually coding the 389 directory server. This list is fine. > > Thanks, > > Aaron Hagopian > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users@xxxxxxxxxxxxxxxxxxxxxxx > https://admin.fedoraproject.org/mailman/listinfo/389-users -- 389 users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/389-users
