+
+
+
Network Working Group J. Sermersheim
Internet-Draft Novell, Inc
-Expires: April 24, 2005 L. Poitou
+Expires: January 18, 2006 L. Poitou
Sun Microsystems
- October 24, 2004
+ July 17, 2005
Password Policy for LDAP Directories
- draft-behera-ldap-password-policy-08.txt
+ draft-behera-ldap-password-policy-09.txt
Status of this Memo
- This document is an Internet-Draft and is subject to all provisions
- of section 3 of RFC 3667. By submitting this Internet-Draft, each
- author represents that any applicable patent or other IPR claims of
- which he or she is aware have been or will be disclosed, and any of
- which he or she become aware will be disclosed, in accordance with
- RFC 3668.
+ By submitting this Internet-Draft, each author represents that any
+ applicable patent or other IPR claims of which he or she is aware
+ have been or will be disclosed, and any of which he or she becomes
+ aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
- other groups may also distribute working documents as
- Internet-Drafts.
+ other groups may also distribute working documents as Internet-
+ Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
- This Internet-Draft will expire on April 24, 2005.
+ This Internet-Draft will expire on January 18, 2006.
Copyright Notice
- Copyright (C) The Internet Society (2004).
+ Copyright (C) The Internet Society (2005).
Abstract
improve the security of LDAP directories and make it difficult for
password cracking programs to break into directories, it is desirable
to enforce a set of rules on password usage. These rules are made to
+ ensure that users change their passwords periodically, passwords meet
-Sermersheim & Poitou Expires April 24, 2005 [Page 1]
+Sermersheim & Poitou Expires January 18, 2006 [Page 1]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
- ensure that users change their passwords periodically, passwords meet
construction requirements, the re-use of old password is restricted,
and users are locked out after a certain number of failed attempts.
LDAP Extensions mailing list <ldapext@ietf.org>. Please send
editorial comments directly to the authors.
-Table of Contents
- 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
- 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 5
- 3. Application of password policy . . . . . . . . . . . . . . . . 6
- 4. Articles of password policy . . . . . . . . . . . . . . . . . 7
- 4.1 Password Usage Policy . . . . . . . . . . . . . . . . . . . . 7
- 4.2 Password Modification Policy . . . . . . . . . . . . . . . . . 7
- 4.3 Restriction of the Password Policy . . . . . . . . . . . . . . 10
- 5. Schema used for Password Policy . . . . . . . . . . . . . . . 11
- 5.1 The pwdPolicy Object Class . . . . . . . . . . . . . . . . . . 11
- 5.2 Attribute Types used in the pwdPolicy ObjectClass . . . . . . 11
- 5.3 Attribute Types for Password Policy State Information . . . . 16
- 6. Controls used for Password Policy . . . . . . . . . . . . . . 20
- 6.1 Request Control . . . . . . . . . . . . . . . . . . . . . . . 20
- 6.2 Response Control . . . . . . . . . . . . . . . . . . . . . . . 20
- 7. Policy Decision Points . . . . . . . . . . . . . . . . . . . . 22
- 7.1 Locked Account Check . . . . . . . . . . . . . . . . . . . . . 22
- 7.2 Password Must be Changed Now Check . . . . . . . . . . . . . . 22
- 7.3 Password Expiration Check . . . . . . . . . . . . . . . . . . 22
- 7.4 Remaining Grace AuthN Check . . . . . . . . . . . . . . . . . 22
- 7.5 Time Before Expiration Check . . . . . . . . . . . . . . . . . 23
- 7.6 Intruder Detection Check . . . . . . . . . . . . . . . . . . . 23
- 7.7 Password Too Young Check . . . . . . . . . . . . . . . . . . . 23
- 8. Server Policy Enforcement Points . . . . . . . . . . . . . . . 24
- 8.1 Password-based Authentication . . . . . . . . . . . . . . . . 24
- 8.2 Password Update Operations . . . . . . . . . . . . . . . . . . 26
- 8.3 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 29
- 9. Client Policy Enforcement Points . . . . . . . . . . . . . . . 30
- 9.1 Bind Operation . . . . . . . . . . . . . . . . . . . . . . . . 30
- 9.2 Modify Operations . . . . . . . . . . . . . . . . . . . . . . 30
- 9.3 Add Operation . . . . . . . . . . . . . . . . . . . . . . . . 31
- 9.4 Compare Operation . . . . . . . . . . . . . . . . . . . . . . 32
- 9.5 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 32
- 10. Administration of the Password Policy . . . . . . . . . . . . 33
- 11. Password Policy and Replication . . . . . . . . . . . . . . . 34
- 12. Security Considerations . . . . . . . . . . . . . . . . . . . 35
- 13. Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . 36
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 2]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
- 14. Normative References . . . . . . . . . . . . . . . . . . . . . 36
- Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 37
- Intellectual Property and Copyright Statements . . . . . . . . 38
+Sermersheim & Poitou Expires January 18, 2006 [Page 2]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+Table of Contents
+
+ 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
+ 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 5
+ 3. Application of password policy . . . . . . . . . . . . . . . . 6
+ 4. Articles of password policy . . . . . . . . . . . . . . . . . 7
+ 4.1 Password Usage Policy . . . . . . . . . . . . . . . . . . . . 7
+ 4.2 Password Modification Policy . . . . . . . . . . . . . . . . . 7
+ 4.3 Restriction of the Password Policy . . . . . . . . . . . . . . 10
+ 5. Schema used for Password Policy . . . . . . . . . . . . . . . 11
+ 5.1 The pwdPolicy Object Class . . . . . . . . . . . . . . . . . . 11
+ 5.2 Attribute Types used in the pwdPolicy ObjectClass . . . . . . 11
+ 5.3 Attribute Types for Password Policy State Information . . . . 16
+ 6. Controls used for Password Policy . . . . . . . . . . . . . . 21
+ 6.1 Request Control . . . . . . . . . . . . . . . . . . . . . . . 21
+ 6.2 Response Control . . . . . . . . . . . . . . . . . . . . . . . 21
+ 7. Policy Decision Points . . . . . . . . . . . . . . . . . . . . 23
+ 7.1 Locked Account Check . . . . . . . . . . . . . . . . . . . . . 23
+ 7.2 Password Must be Changed Now Check . . . . . . . . . . . . . . 23
+ 7.3 Password Expiration Check . . . . . . . . . . . . . . . . . . 23
+ 7.4 Remaining Grace AuthN Check . . . . . . . . . . . . . . . . . 23
+ 7.5 Time Before Expiration Check . . . . . . . . . . . . . . . . . 24
+ 7.6 Intruder Detection Check . . . . . . . . . . . . . . . . . . . 24
+ 7.7 Password Too Young Check . . . . . . . . . . . . . . . . . . . 24
+ 8. Server Policy Enforcement Points . . . . . . . . . . . . . . . 25
+ 8.1 Password-based Authentication . . . . . . . . . . . . . . . . 25
+ 8.2 Password Update Operations . . . . . . . . . . . . . . . . . . 27
+ 8.3 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 30
+ 9. Client Policy Enforcement Points . . . . . . . . . . . . . . . 31
+ 9.1 Bind Operation . . . . . . . . . . . . . . . . . . . . . . . . 31
+ 9.2 Modify Operations . . . . . . . . . . . . . . . . . . . . . . 32
+ 9.3 Add Operation . . . . . . . . . . . . . . . . . . . . . . . . 33
+ 9.4 Compare Operation . . . . . . . . . . . . . . . . . . . . . . 33
+ 9.5 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 34
+ 10. Administration of the Password Policy . . . . . . . . . . . . 35
+ 11. Password Policy and Replication . . . . . . . . . . . . . . . 36
+ 12. Security Considerations . . . . . . . . . . . . . . . . . . . 37
+ 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 38
+ 14. Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . 39
+ 15. Normative References . . . . . . . . . . . . . . . . . . . . . 39
+ Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 40
+ Intellectual Property and Copyright Statements . . . . . . . . 41
-Sermersheim & Poitou Expires April 24, 2005 [Page 3]
+Sermersheim & Poitou Expires January 18, 2006 [Page 3]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
1. Overview
other things, this policy includes:
o Whether and when passwords expire.
+
o Whether failed bind attempts cause the account to be locked.
+
o If and how users are able to change their passwords.
In order to achieve greater security protection and ensure
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 4]
+Sermersheim & Poitou Expires January 18, 2006 [Page 4]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
2. Conventions
-Sermersheim & Poitou Expires April 24, 2005 [Page 5]
+Sermersheim & Poitou Expires January 18, 2006 [Page 5]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
3. Application of password policy
-Sermersheim & Poitou Expires April 24, 2005 [Page 6]
+Sermersheim & Poitou Expires January 18, 2006 [Page 6]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
4. Articles of password policy
4.1.1 Password Guessing Limit
In order to prevent intruders from guessing a user's password, a
- mechanism exists to track the number of failed authentication
- attempts, and take action when a limit is reached. This policy
- consists of five parts:
+ mechanism exists to track the number of consecutive failed
+ authentication attempts, and take action when a limit is reached.
+ This policy consists of five parts:
o A configurable limit on failed authentication attempts.
+
o A counter to track the number of failed authentication attempts.
+
o A timeframe in which the limit of consecutive failed
authentication attempts must happen before action is taken.
+
o The action to be taken when the limit is reached. The action will
either be nothing, or the account will be locked.
+
o An amount of time the account is locked (if it is to be locked).
This can be indefinite.
+
4.2 Password Modification Policy
This section describes policy enforced while users are modifying
password attribute during an add or modify operation, but MAY be done
by other means such as an extended operation.
-4.2.1 Password Expiration, Expiration Warning, and Grace
- Authentications
- One of the key properties of a password is the fact that it is not
- well known. If a password is frequently changed, the chances of that
- user's account being broken into are minimized.
-Sermersheim & Poitou Expires April 24, 2005 [Page 7]
+Sermersheim & Poitou Expires January 18, 2006 [Page 7]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+4.2.1 Password Expiration, Expiration Warning, and Grace
+ Authentications
+ One of the key properties of a password is the fact that it is not
+ well known. If a password is frequently changed, the chances of that
+ user's account being broken into are minimized.
Password policy administrators may deploy a password policy that
causes passwords to expire after a given amount of time - thus
o A warning may be returned to the user sometime before his password
is due to expire. If the user fails to heed this warning before
the expiration time, his account will be locked.
+
o The user may bind to the directory a preset number of times after
her password has expired. If she fails to change her password
during one of her 'grace' authentications, her account will be
locked.
+
4.2.2 Password History
When the Password Expiration policy is used, an additional mechanism
This process may be made less attractive to users by employing a
minimum age for passwords. If users are forced to wait 24 hours
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 8]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
between password changes, they may be less likely to cycle through a
history of 10 passwords.
are easy to guess, a password quality policy may be employed. This
policy consists of two general mechanisms - ensuring that passwords
conform to a defined quality criterion and ensuring that they are of
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 8]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
a minimum length.
Forcing a password to comply with the quality policy may imply a
variety of things including:
o Disallowing trivial or well-known words make up the password.
+
o Forcing a certain number of digits be used.
+
o Disallowing anagrams of the user's name.
The implementation of this policy meets with the following problems:
before being sent, the server has no way of enforcing this policy.
Therefore, the onus of enforcing this policy falls upon client
implementations.
+
o There are no specific definitions of what 'quality checking'
means. This can lead to unexpected behavior in a heterogeneous
environment.
+
4.2.5 User Defined Passwords
In some cases, it is desirable to disallow users from adding and
updating their own passwords. This policy makes this functionality
possible.
- This implies that certain other policy, such as password expiration
- is not enforced.
-
4.2.6 Password Change after Reset
This policy forces the user to update her password after it has been
This is needed in scenarios where a password administrator has set or
reset the password to a well-known value.
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 9]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
4.2.7 Safe Modification
As directories become more commonly used, it will not be unusual for
This policy forces the user to prove his identity by specifying the
old password during a password modify operation.
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 9]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
{TODO: This allows a dictionary attack unless we specify that this is
- also subject to intruder detection}
+ also subject to intruder detection. One solution is to require users
+ to authN prior to changing password. Another solution is to perform
+ intruder detection checks when the password for a non-authenticated
+ identity is being updated}
4.3 Restriction of the Password Policy
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 10]
+Sermersheim & Poitou Expires January 18, 2006 [Page 10]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
5. Schema used for Password Policy
$ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $
pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) )
+
5.2 Attribute Types used in the pwdPolicy ObjectClass
Following are the attribute types used by the pwdPolicy object class.
EQUALITY objectIdentifierMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+
5.2.2 pwdMinAge
This attribute holds the number of seconds that must elapse between
modifications to the password. If this attribute is not present, 0
seconds is assumed.
- ( 1.3.6.1.4.1.42.2.27.8.1.2
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 11]
+Sermersheim & Poitou Expires January 18, 2006 [Page 11]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ ( 1.3.6.1.4.1.42.2.27.8.1.2
NAME 'pwdMinAge'
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.3 pwdMaxAge
This attribute holds the number of seconds after which a modified
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.4 pwdInHistory
This attribute specifies the maximum number of used passwords stored
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.5 pwdCheckQuality
{TODO: Consider changing the syntax to OID. Each OID will list a
quality rule (like min len, # of special characters, etc). These
- rules can be specified outsid ethis document.}
+ rules can be specified outside this document.}
{TODO: Note that even though this is meant to be a check that happens
during password modification, it may also be allowed to happen during
authN. This is useful for situations where the password is encrypted
- when modified, but decrypted when used to authN.}
-
- This attribute indicates how the password quality will be verified
- while being modified or added. If this attribute is not present, or
-Sermersheim & Poitou Expires April 24, 2005 [Page 12]
+Sermersheim & Poitou Expires January 18, 2006 [Page 12]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ when modified, but decrypted when used to authN.}
+
+ This attribute indicates how the password quality will be verified
+ while being modified or added. If this attribute is not present, or
if the value is '0', quality checking will not be enforced. A value
of '1' indicates that the server will check the quality, and if the
server is unable to check it (due to a hashed password or other
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.6 pwdMinLength
When quality checking is enabled, this attribute holds the minimum
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.7 pwdExpireWarning
This attribute specifies the maximum number of seconds before a
( 1.3.6.1.4.1.42.2.27.8.1.7
NAME 'pwdExpireWarning'
EQUALITY integerMatch
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
- SINGLE-VALUE )
-5.2.8 pwdGraceAuthNLimit
- This attribute specifies the number of times an expired password can
+Sermersheim & Poitou Expires January 18, 2006 [Page 13]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
-Sermersheim & Poitou Expires April 24, 2005 [Page 13]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+ SINGLE-VALUE )
+
+5.2.8 pwdGraceAuthNLimit
+ This attribute specifies the number of times an expired password can
be used to authenticate. If this attribute is not present or if the
value is 0, authentication will fail.
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.9 pwdLockout
This attribute indicates, when its value is "TRUE", that the password
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
+
5.2.10 pwdLockoutDuration
This attribute holds the number of seconds that the password cannot
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 14]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
5.2.11 pwdMaxFailure
This attribute specifies the number of consecutive failed bind
If this attribute is not present, or if the value is 0, this policy
is not checked, and the value of pwdLockout will be ignored.
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 14]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
( 1.3.6.1.4.1.42.2.27.8.1.11
NAME 'pwdMaxFailure'
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.12 pwdFailureCountInterval
This attribute holds the number of seconds after which the password
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.13 pwdMustChange
This attribute specifies with a value of "TRUE" that users must
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 15]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
5.2.14 pwdAllowUserChange
This attribute indicates whether users can change their own
access control mechanism.
( 1.3.6.1.4.1.42.2.27.8.1.14
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 15]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
NAME 'pwdAllowUserChange'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
+
5.2.15 pwdSafeModify
This attribute specifies whether or not the existing password must be
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
+
5.3 Attribute Types for Password Policy State Information
Password policy state information must be maintained for each user.
(1.3.6.1.4.1.1466.115.121.1.38). The attribute type descriptor
(short name) MUST be used.
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 16]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
For example, if the pwdPolicy object has for pwdAttribute
"userPassword" then the pwdChangedTime operational attribute, in a
user entry, will be:
operation, and does not specify an option, all subtypes of that
policy state attribute are returned.
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 16]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
5.3.2 pwdChangedTime
This attribute specifies the last time the entry's password was
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
SINGLE-VALUE
+ NO-USER-MODIFICATION
USAGE directoryOperation )
+
5.3.3 pwdAccountLockedTime
This attribute holds the time that the user's account was locked. A
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
SINGLE-VALUE
+ NO-USER-MODIFICATION
USAGE directoryOperation )
+
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 17]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
5.3.4 pwdFailureTime
This attribute holds the timestamps of the consecutive authentication
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+ NO-USER-MODIFICATION
USAGE directoryOperation )
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 17]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
5.3.5 pwdHistory
This attribute holds a history of previously used passwords. Values
( 1.3.6.1.4.1.42.2.27.8.1.20
NAME 'pwdHistory'
DESC 'The history of user s passwords'
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 18]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
EQUALITY octetStringMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
+ NO-USER-MODIFICATION
USAGE directoryOperation )
+
5.3.6 pwdGraceUseTime
This attribute holds the timestamps of grace authentications after a
password has expired'
EQUALITY generalizedTimeMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 18]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
+ NO-USER-MODIFICATION
USAGE directoryOperation )
+
5.3.7 pwdReset
This attribute holds a flag to indicate (when TRUE) that the password
has been updated by the password administrator and must be changed by
- the user on first authentication.
+ the user.
( 1.3.6.1.4.1.42.2.27.8.1.22
NAME 'pwdReset'
SINGLE-VALUE
USAGE directoryOperation )
+
5.3.8 pwdPolicySubentry
This attribute points to the pwdPolicy subentry in effect for this
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
SINGLE-VALUE
+ NO-USER-MODIFICATION
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 19]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
USAGE directoryOperation )
-Sermersheim & Poitou Expires April 24, 2005 [Page 19]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 20]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
6. Controls used for Password Policy
response control contains various warnings and errors associated with
password policy.
+ {TODO: add a note about advertisement and discovery}
+
6.1 Request Control
This control MAY be sent with any LDAP request message in order to
passwordInHistory (8) } OPTIONAL }
The timeBeforeExpiration warning specifies the number of seconds
- before a password will expire. The graceAuthNsRemaining warning
- specifies the remaining number of times a user will be allowed to
-Sermersheim & Poitou Expires April 24, 2005 [Page 20]
+Sermersheim & Poitou Expires January 18, 2006 [Page 21]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ before a password will expire. The graceAuthNsRemaining warning
+ specifies the remaining number of times a user will be allowed to
authenticate with an expired password. The passwordExpired error
signifies that the password has expired and must be reset. The
changeAfterReset error signifies that the password must be changed
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 21]
+Sermersheim & Poitou Expires January 18, 2006 [Page 22]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
7. Policy Decision Points
if any of these conditions are met:
o The value of the pwdAccountLockedTime attribute is 000001010000Z.
+
o The current time is less than the value of the
pwdAccountLockedTime attribute added to the value of the
pwdLockoutDuration.
if all of these conditions are met:
The pwdMustChange attribute is set to TRUE.
+
The pwdReset attribute is set to TRUE.
Otherwise a status of false is returned.
7.3 Password Expiration Check
A status of true is returned indicating that the password has expired
- if the value of the pwdExpireWarning attribute is 0, and the current
- time minus the value of pwdChangedTime is greater than the value of
- the pwdMaxAge.
+ if the current time minus the value of pwdChangedTime is greater than
+ the value of the pwdMaxAge.
Otherwise, a status of false is returned.
If the pwdGraceUseTime attribute is present, the number of values in
that attribute subtracted from the value of pwdGraceAuthNLimit is
returned. Otherwise zero is returned. A positive result specifies
- the number of remaining grace authentications.
-Sermersheim & Poitou Expires April 24, 2005 [Page 22]
+Sermersheim & Poitou Expires January 18, 2006 [Page 23]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ the number of remaining grace authentications.
+
7.5 Time Before Expiration Check
If the pwdExpireWarning attribute is not present a zero status is
returned if the following conditions are met:
The pwdLockout attribute is TRUE.
+
The number of values in the pwdFailureTime attribute that are
younger than pwdFailureCountInterval is greater or equal to the
pwdMaxFailure attribute.
password was last updated is returned if:
The value of pwdMinAge is non-zero and pwdChangedTime is present.
+
The value of pwdMinAge is greater than the current time minus the
value of pwdChangedTime.
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 23]
+Sermersheim & Poitou Expires January 18, 2006 [Page 24]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
8. Server Policy Enforcement Points
updates used while validating a password. Operations that validate
passwords include, but are not limited to, the Bind operation where
the simple choice specifies a password, and the compare operation
- where the attribute being compared holds a password.
+ where the attribute being compared holds a password. Note that while
+ the compare operation does not authenticate a user to the LDAP
+ server, it may be used by an external application for purposes of
+ authentication.
8.1.1 Fail if the account is locked
the error: accountLocked (1) in the passwordPolicyResponse in the
controls field of the message.
-8.1.2 AuthN Passed Procedures
+8.1.2 Validated Password Procedures
- If the authentication process indicates that the password validated,
+ If the validation operation indicates that the password validated,
these procedures are followed in order:
8.1.2.1 Policy state updates
If the decision in Section 7.2 returns true, the server sends to the
client a response with an appropriate successful resultCode (i.e.
- success (0), compareTrue (6), etc.), and includes the
- passwordPolicyResponse in the controls field of the bindResponse
- message with the warning: changeAfterReset specified.
-Sermersheim & Poitou Expires April 24, 2005 [Page 24]
+Sermersheim & Poitou Expires January 18, 2006 [Page 25]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ success (0), compareTrue (6), etc.), and includes the
+ passwordPolicyResponse in the controls field of the bindResponse
+ message with the warning: changeAfterReset specified.
+
For bind, the server MUST then disallow all operations issued by this
user except modify password, bind, unbind, abandon and StartTLS
extended operation.
If there are remaining grace authentications as per Section 7.4, the
server adds a new value with the current time in pwdGraceUseTime.
Then it sends to the client a response with an appropriate successful
- resultCode (i.e. success (0), compareTrue (6), etc.), and includes
+ resultCode (i.e. success (0), compareTrue (6), etc.), and includes
the passwordPolicyResponse in the controls field of the response
message with the warning: graceAuthNsRemaining choice set to the
number of grace authentications left.
If the result of Section 7.5 is a positive number, the server sends
to the client a response with an appropriate successful resultCode
- (i.e. success (0), compareTrue (6), etc.), and includes the
+ (i.e. success (0), compareTrue (6), etc.), and includes the
passwordPolicyResponse in the controls field of the bindResponse
message with the warning: timeBeforeExiration set to the value as
described above. Otherwise, the server sends a successful response,
and omits the passwordPolicyResponse.
-8.1.2.5 AuthN Failed Procedures
- If the authentication process indicates that the password failed
- validation due to invalid credentials, these procedures are followed:
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 25]
+Sermersheim & Poitou Expires January 18, 2006 [Page 26]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+8.1.2.5 AuthN Failed Procedures
+ If the authentication process indicates that the password failed
+ validation due to invalid credentials, these procedures are followed:
8.1.2.5.1 Policy state update
When the LDAP modify operation is used to modify a password, this is
done by specifying both a delete action and an add or replace action,
- where the delete action is first, and specifies the existing
- password, and the add or replace action specifies the new password.
- Other password update operations SHOULD employ a similar mechanism.
- Otherwise this policy will fail.
+ where the delete action specifies the existing password, and the add
+ or replace action specifies the new password. Other password update
+ operations SHOULD employ a similar mechanism. Otherwise this policy
+ will fail.
- If the existing password is not specified, the server does not
- process the operation and sends the appropriate response message to
- the client with the resultCode: insufficientAccessRights (50), and
- includes the passwordPolicyResponse in the controls field of the
- response message with the error: mustSupplyOldPassword (4).
-Sermersheim & Poitou Expires April 24, 2005 [Page 26]
+Sermersheim & Poitou Expires January 18, 2006 [Page 27]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+ If the existing password is not specified, the server does not
+ process the operation and sends the appropriate response message to
+ the client with the resultCode: insufficientAccessRights (50), and
+ includes the passwordPolicyResponse in the controls field of the
+ response message with the error: mustSupplyOldPassword (4).
8.2.2 Change After Reset
If the value is 1, operation continues. If the value is 2, the
server sends a response message to the client with the resultCode:
constraintViolation (19), and includes the passwordPolicyResponse
- in the controls field of the response message with the error:
- insufficientPasswordQuality (5).
- If the server is able to check the password quality, and the check
- fails, the server sends a response message to the client with the
- resultCode: constraintViolation (19), and includes the
- passwordPolicyResponse in the controls field of the response
-Sermersheim & Poitou Expires April 24, 2005 [Page 27]
+Sermersheim & Poitou Expires January 18, 2006 [Page 28]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ in the controls field of the response message with the error:
+ insufficientPasswordQuality (5).
+ If the server is able to check the password quality, and the check
+ fails, the server sends a response message to the client with the
+ resultCode: constraintViolation (19), and includes the
+ passwordPolicyResponse in the controls field of the response
message with the error: insufficientPasswordQuality (5).
+
o checks the value of the pwdMinLength attribute. If the value is
non-zero, it ensures that the new password is of at least the
minimum length.
passwordPolicyResponse in the controls field of the response
message with the error: passwordTooShort (6).
+
8.2.6 Invalid Reuse
If pwdInHistory is present and its value is non-zero, the server
If the value of pwdInHistory is non-zero, the server adds the
previous password (if one existed) to the pwdHistory attribute. If
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 29]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
the number of attributes held in the pwdHistory attribute exceeds the
value of pwdInHistory, the server removes the oldest excess
passwords.
set to TRUE. Otherwise, the pwdReset is removed from the user's
entry if it exists.
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 28]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
- The pwdFailureTime, pwdGraceUseTime and pwdExpirationWarned
- attributes is removed from the user's entry if they exist.
+ The pwdFailureTime and pwdGraceUseTime attributes is removed from the
+ user's entry if they exist.
8.3 Other Operations
-
-
-
-
-
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 29]
+Sermersheim & Poitou Expires January 18, 2006 [Page 30]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
9. Client Policy Enforcement Points
failure limit has been reached and the account is locked. The
user needs to retry later or contact the password administrator to
reset the password.
+
o bindResponse.resultCode = success (0),
passwordPolicyResponse.error = changeAfterReset (2): The user is
binding for the first time after the password administrator set
the password. In this scenario, the client SHOULD prompt the user
to change his password immediately.
+
o bindResponse.resultCode = success (0),
passwordPolicyResponse.warning = graceAuthNsRemaining: The
password has expired but there are remaining grace
authentications. The user needs to change it.
+
o bindResponse.resultCode = invalidCredentials (49),
passwordPolicyResponse.error = passwordExpired (0): The password
has expired and there are no more grace authentications. The user
contacts the password administrator in order to have its password
reset.
+
o bindResponse.resultCode = success (0),
passwordPolicyResponse.warning = timeBeforeExpiration: The user's
password will expire in n number of seconds.
-9.2 Modify Operations
-9.2.1 Modify Request
- If the application or client encrypts the password prior to sending
- it in a password modification operation (whether done through
-Sermersheim & Poitou Expires April 24, 2005 [Page 30]
+Sermersheim & Poitou Expires January 18, 2006 [Page 31]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+9.2 Modify Operations
+
+9.2.1 Modify Request
+
+ If the application or client encrypts the password prior to sending
+ it in a password modification operation (whether done through
modifyRequest or another password modification mechanism), it SHOULD
check the values of the pwdMinLength, and pwdCheckQuality attributes
and SHOULD enforce these policies.
passwordPolicyResponse.error = mustSupplyOldPassword (4): The user
attempted to change her password without specifying the old
password but the password policy requires this.
+
o <pwdModResponse>.resultCode = insufficientAccessRights (50),
passwordPolicyResponse.error = changeAfterReset (2): The user must
change her password before submitting any other LDAP requests.
+
o <pwdModResponse>.resultCode = insufficientAccessRights (50),
passwordPolicyResponse.error = passwordModNotAllowed (3): The user
doesn't have sufficient rights to change his password.
+
o <pwdModResponse>.resultCode = constraintViolation (19),
passwordPolicyResponse.error = passwordTooYoung (7): It is too
soon after the last password modification to change the password.
+
o <pwdModResponse>.resultCode = constraintViolation (19),
passwordPolicyResponse.error = insufficientPasswordQuality (5):
The password failed quality checking.
+
o <pwdModResponse>.resultCode = constraintViolation (19),
passwordPolicyResponse.error = passwordTooShort (6): The length of
the password is too short.
+
o <pwdModResponse>.resultCode = constraintViolation (19),
passwordPolicyResponse.error = passwordInHistory (8): The password
has already been used; the user must choose a different one.
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 32]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
9.3 Add Operation
If a password is specified in an addRequest, the client checks the
passwordPolicyResponse.error = passwordModNotAllowed (3): The user
doesn't have sufficient rights to add this password.
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 31]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
o addResponse.resultCode = constraintViolation (19),
passwordPolicyResponse.error = insufficientPasswordQuality (5):
The password failed quality checking.
+
o addResponse.resultCode = constraintViolation (19),
passwordPolicyResponse.error = passwordTooShort (6): The length of
the password is too short.
+
9.4 Compare Operation
When a compare operation is used to compare a password, the client
failure limit has been reached and the account is locked. The
user needs to retry later or contact the password administrator to
reset the password.
+
o compareResponse.resultCode = compareTrue (6),
passwordPolicyResponse.warning = graceAuthNsRemaining: The
password has expired but there are remaining grace
authentications. The user needs to change it.
+
o compareResponse.resultCode = compareFalse (5),
passwordPolicyResponse.error = passwordExpired (0): The password
has expired and there are no more grace authentications. The user
must contact the password administrator to reset the password.
+
o compareResponse.resultCode = compareTrue (6),
passwordPolicyResponse.warning = timeBeforeExpiration: The user's
password will expire in n number of seconds.
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 33]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
9.5 Other Operations
For operations other than bind, unbind, abandon or StartTLS, the
-Sermersheim & Poitou Expires April 24, 2005 [Page 32]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 34]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
10. Administration of the Password Policy
-Sermersheim & Poitou Expires April 24, 2005 [Page 33]
+Sermersheim & Poitou Expires January 18, 2006 [Page 35]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
11. Password Policy and Replication
+ {TODO: This section needs to be changed to highlight the pitfals of
+ replication, sugest some implementation choices to overcome those
+ pitfals, but remove prescriptive language relating to the update of
+ state information}
+
The pwdPolicy object defines the password policy for a portion of the
DIT and MUST be replicated on all the replicas of this subtree, as
any subentry would be, in order to have a consistent policy among all
doesn't have to be replicated to a read-only replica, since the
password will never be directly modified on this server.
- The pwdAccountLockedTime, pwdExpirationWarned, pwdFailureTime and
- pwdGraceUseTime attributes MUST be replicated to writable replicas,
- making the password policy global for all servers. When the user
- entry is replicated to a read-only replica, these attributes SHOULD
- NOT be replicated. This means that the number of failures, of grace
+ The pwdAccountLockedTime, pwdFailureTime and pwdGraceUseTime
+ attributes MUST be replicated to writable replicas, making the
+ password policy global for all servers. When the user entry is
+ replicated to a read-only replica, these attributes SHOULD NOT be
+ replicated. This means that the number of failures, of grace
authentications and the locking will take place on each replicated
server. For example, the effective number of failed attempts on a
user password will be N x M (where N is the number of servers and M
-
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 34]
+Sermersheim & Poitou Expires January 18, 2006 [Page 36]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
12. Security Considerations
-Sermersheim & Poitou Expires April 24, 2005 [Page 35]
+Sermersheim & Poitou Expires January 18, 2006 [Page 37]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+13. IANA Considerations
+
+ <<<TBD>>>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-13. Acknowledgement
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 38]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+14. Acknowledgement
This document is based in part on prior work done by Valerie Chu from
Netscape Communications Corp, published as
draft-vchu-ldap-pwd-policy-00.txt (December 1998). Prasanta Behera
participated in early revisions of this document.
-14 Normative References
+15. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC2195] Klensin, J., Catoe, R. and P. Krumviede, "IMAP/POP
- AUTHorize Extension for Simple Challenge/Response", RFC
- 2195, September 1997.
+ [RFC2195] Klensin, J., Catoe, R., and P. Krumviede, "IMAP/POP
+ AUTHorize Extension for Simple Challenge/Response",
+ RFC 2195, September 1997.
[RFC2222] Myers, J., "Simple Authentication and Security Layer
(SASL)", RFC 2222, October 1997.
- [RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory
+ [RFC2251] Wahl, M., Howes, T., and S. Kille, "Lightweight Directory
Access Protocol (v3)", RFC 2251, December 1997.
- [RFC2252] Wahl, M., Coulbeck, A., Howes, T. and S. Kille,
+ [RFC2252] Wahl, M., Coulbeck, A., Howes, T., and S. Kille,
"Lightweight Directory Access Protocol (v3): Attribute
Syntax Definitions", RFC 2252, December 1997.
- [RFC2829] Wahl, M., Alvestrand, H., Hodges, J. and R. Morgan,
+ [RFC2829] Wahl, M., Alvestrand, H., Hodges, J., and R. Morgan,
"Authentication Methods for LDAP", RFC 2829, May 2000.
[RFC2831] Leach, P. and C. Newman, "Using Digest Authentication as a
-Sermersheim & Poitou Expires April 24, 2005 [Page 36]
+Sermersheim & Poitou Expires January 18, 2006 [Page 39]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
Encoding Rules (BER), Canonical Encoding Rules (CER) and
USA
Phone: +1 801 861-3088
- EMail: jimse@novell.com
+ Email: jimse@novell.com
Ludovic Poitou
France
Phone: +33 476 188 212
- EMail: ludovic.poitou@sun.com
+ Email: ludovic.poitou@sun.com
-Sermersheim & Poitou Expires April 24, 2005 [Page 37]
+Sermersheim & Poitou Expires January 18, 2006 [Page 40]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
Intellectual Property Statement
Copyright Statement
- Copyright (C) The Internet Society (2004). This document is subject
+ Copyright (C) The Internet Society (2005). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
-Sermersheim & Poitou Expires April 24, 2005 [Page 38]
+Sermersheim & Poitou Expires January 18, 2006 [Page 41]
\f
+
projects / openldap / blobdiff