SLAPO_PPOLICY(5) File Formats Manual SLAPO_PPOLICY(5) (NAME) slapo-ppolicy - slapd (SYNOPSIS) /etc/openldap/slapd.conf (DESCRIPTION) ppolicy IETF LDAP . . . -- (grace logins) . . rootdn . rootdn . manage userPassword IETF . IETF LDAP userPassword . userPassword . IETF SunDS (1.3.6.1.4.1.42.2.27.9.5.8) Netscape . (CONFIGURATION) slapd.conf ppolicy . overlay . ppolicy_default (DN) pwdPolicy . . ppolicy_forward_updates Bind ( ) (consumer) (provider) . (replication consumer) updateref chain . ppolicy_hash_cleartext (cleartext) Add Modify . X.500/LDAP LDAP Password Modify . compare search read . ppolicy_use_lockout Bind LDAP InvalidCredentials . Password Policy Bind Password Policy . Password Policy AccountLocked . AccountLocked . ppolicy_send_netscape_controls ppolicy (2.16.840.1.113730.3.4.4) (2.16.840.1.113730.3.4.5) . bind Password policy . . ppolicy_check_module check_password() . pwdPolicyChecker . : PATH slapd . : ppolicy_check_module LDAP . (OBJECT CLASS) ppolicy pwdPolicy . : ( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' AUXILIARY SUP top MUST ( pwdAttribute ) MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheckQuality $ pwdMinLength $ pwdMaxLength $ pwdExpireWarning $ pwdGraceAuthnLimit $ pwdGraceExpiry $ pwdLockout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify $ pwdMaxRecordedFailure $ pwdMinDelay $ pwdMaxDelay $ pwdMaxIdle ) ) pwdPolicy (structural) . namedPolicy . namedPolicy cn rDN . pwdPolicyChecker ( ). ( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' AUXILIARY SUP top MAY ( pwdCheckModule $ pwdCheckModuleArg $ pwdUseCheckModule ) ) pwdPolicySubentry DN pwdPolicy . . (OBJECT CLASS ATTRIBUTES) pwdPolicy . pwdAttribute . userPassword . : pwdAttribute userPassword . ( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) pwdMinAge . ( ). ( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdMaxAge . (0) . ( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdInHistory pwdHistory . pwdInHistory (0) pwdHistory . rootdn . ( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdCheckQuality . (0) . (1) . (2) . ( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdMinLength ( pwdCheckQuality ) . . pwdCheckQuality ( pwdCheckQuality (0) (1) ) ( pwdCheckQuality (2) ). ppolicy_check_module . ( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdMaxLength ( pwdCheckQuality ) . . pwdCheckQuality ( pwdCheckQuality (0) (1) ) ( pwdCheckQuality (2) ). ppolicy_check_module . ( 1.3.6.1.4.1.42.2.27.8.1.31 NAME 'pwdMaxLength' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdExpireWarning . (0) . ( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdGraceAuthnLimit . (0) . ( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthnLimit' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdGraceExpiry . (0) . ( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdGraceExpiry' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdLockout . pwdLockout ( "TRUE" ) bind . bind pwdMaxFailure . pwdLockout "FALSE" bind . ( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) pwdLockoutDuration bind . ( pwdLockout pwdMaxFailure .) pwdLockoutDuration (0) . ( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdMaxFailure bind . pwdMaxFailure (0) bind DN . ( pwdLockout pwdLockoutDuration .) ( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdMaxRecordedFailure bind . pwdMaxRecordedFailure (0) pwdMaxFailure . 0 5 . ( 1.3.6.1.4.1.42.2.27.8.1.32 NAME 'pwdMaxRecordedFailure' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdFailureCountInterval bind . pwdFailureCountInterval (0) . ( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInterval' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdMustChange bind . pwdMustChange "TRUE" bind . pwdMustChange "FALSE" bind . ( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) pwdAllowUserChange . pwdAllowUserChange "TRUE" . "FALSE" . : pwdAllowUserChange "TRUE" . . pwdAllowUserChange . OpenLDAP ACL ( slapd.access(5) ). ( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) pwdSafeModify . pwdSafeModify "TRUE" . "FALSE" . ( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) pwdMinDelay . (0) . pwdMinDelay pwdMaxDelay . bind . ( 1.3.6.1.4.1.42.2.27.8.1.24 NAME 'pwdMinDelay' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdMaxDelay . pwdMinDelay pwdMaxDelay ( ). pwdMaxDelay pwdMinDelay . bind . ( 1.3.6.1.4.1.42.2.27.8.1.25 NAME 'pwdMaxDelay' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdMaxIdle . (0) . lastbind olcLastBind TRUE . ( 1.3.6.1.4.1.42.2.27.8.1.26 NAME 'pwdMaxIdle' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) pwdUseCheckModule/pwdCheckModuleArg pwdUseCheckModule ppolicy_check_module . check_password() . pwdCheckQuality (1) (2) . : int check_password (char *pPasswd, struct berval *pErrmsg, Entry *pEntry, struct berval *pArg); pPasswd pErrmsg struct berval . bv_len bv_val . pEntry NULL . pArg struct berval pwdCheckModuleArg NULL . pErrmsg NULL funcName . LDAP_SUCCESS . pErrmsg . slapd free() . pwdCheckModule . ( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 OBSOLETE SINGLE-VALUE ) ( 1.3.6.1.4.1.4754.1.99.2 NAME 'pwdCheckModuleArg' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Argument to pass to check_password() function' SINGLE-VALUE ) ( 1.3.6.1.4.1.4754.1.99.3 NAME 'pwdUseCheckModule' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) (OPERATIONAL ATTRIBUTES) ppolicy . . ppolicy . IETF (replication) . (replica) (provider) . ( ). . userPassword userPassword ppolicy . . OpenLDAP . pwdPolicySubentry pwdPolicy . pwdPolicySubentry DN pwdPolicy . ppolicy DN . . ( 1.3.6.1.4.1.42.2.27.8.1.23 NAME 'pwdPolicySubentry' DESC 'The pwdPolicy subentry in effect for this object' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE USAGE directoryOperation) pwdChangedTime . . pwdChangedTime . ( 1.3.6.1.4.1.42.2.27.8.1.16 NAME 'pwdChangedTime' DESC 'The time the password was last changed' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation) pwdAccountLockedTime . . pwdAccountLockedTime 000001010000Z . pwdLockout "TRUE" . ( 1.3.6.1.4.1.42.2.27.8.1.17 NAME 'pwdAccountLockedTime' DESC 'The time an user account was locked' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE USAGE directoryOperation) pwdFailureTime DN ( ) . ( pwdMaxFailure ) pwdLockout "TRUE" . ( pwdLockout .) pwdMaxFailure pwdMaxRecordedFailure . DN ( ) pwdFailureTime . ( 1.3.6.1.4.1.42.2.27.8.1.19 NAME 'pwdFailureTime' DESC 'The timestamps of the last consecutive authentication failures' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch NO-USER-MODIFICATION USAGE directoryOperation ) pwdHistory DN ( ) . : pwdHistory= time "#" syntaxOID "#" length "#" data time= GeneralizedTime 3.3.13 [RFC4517] syntaxOID = numericoid OID . numericoid 1.4 [RFC4512] . length = NumericString () data. NumericString 3.3.23 [RFC4517] . data = syntaxOID . . time GMT . ( 1.3.6.1.4.1.42.2.27.8.1.20 NAME 'pwdHistory' DESC 'The history of user passwords' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 EQUALITY octetStringMatch NO-USER-MODIFICATION USAGE directoryOperation) pwdGraceUseTime DN . << (grace logins)>> . ( pwdGraceAuthnLimit ) DN userPassword DN . ( 1.3.6.1.4.1.42.2.27.8.1.21 NAME 'pwdGraceUseTime' DESC 'The timestamps of the grace login once the password has expired' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch NO-USER-MODIFICATION USAGE directoryOperation) pwdReset DN . pwdReset "TRUE" . "FALSE" . ( 1.3.6.1.4.1.42.2.27.8.1.22 NAME 'pwdReset' DESC 'The indication that the password has been reset' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE directoryOperation) pwdStartTime . . . ( 1.3.6.1.4.1.42.2.27.8.1.27 NAME 'pwdStartTime' DESC 'The time the password becomes enabled' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE USAGE directoryOperation ) pwdEndTime . . . ( 1.3.6.1.4.1.42.2.27.8.1.28 NAME 'pwdEndTime' DESC 'The time the password becomes disabled' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE USAGE directoryOperation ) pwdStartTime pwdEndTime . pwdAccountTmpLockoutEnd pwdMinDelay . ( 1.3.6.1.4.1.42.2.27.8.1.33 NAME 'pwdAccountTmpLockoutEnd' DESC 'Temporary lockout end' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) SunDS (SUNDS ACCOUNT USABILITY CONTROL) SunDS : o o compare . o (EXAMPLES) database mdb suffix dc=example,dc=com ... overlay ppolicy ppolicy_default "cn=Standard,ou=Policies,dc=example,dc=com" (SEE ALSO) ldap(3) slapd.conf(5) slapd-config(5) slapo-chain(5). << OpenLDAP>> (http://www.OpenLDAP.org/doc/admin) IETF LDAP P. Behera L. Poitou J. Sermersheim: IETF <>. (BUGS) LDAP . . (ACKNOWLEDGEMENTS) 2004 Howard Chu Symas Corporation Neil Dunbar Kartik Subbarao Hewlett-Packard . . IETF LDAP P. Behera L. Poitou J. Sermersheim . IETF draft-behera-ldap-password- policy-10.txt 2009 . OpenLDAP Software OpenLDAP . OpenLDAP Software LDAP 3.3 . OpenLDAP 2.6.13 2026/03/09 SLAPO_PPOLICY(5)