Add -s warning

[openldap] / doc / man / man5 / slapo-ppolicy.5

diff --git a/doc/man/man5/slapo-ppolicy.5 b/doc/man/man5/slapo-ppolicy.5
index cc95469adb33c5ff3c1053ca7989a5ebb9402c15..214a4d9de41336d20f83b288286bc34892e2f1f7 100644 (file)
--- a/doc/man/man5/slapo-ppolicy.5
+++ b/doc/man/man5/slapo-ppolicy.5
@@ -1,5 +1,5 @@
 .\" $OpenLDAP$
-.\" Copyright 2004-2005 The OpenLDAP Foundation All Rights Reserved.
+.\" Copyright 2004-2006 The OpenLDAP Foundation All Rights Reserved.
 .\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
 .TH SLAPO_PPOLICY 5 "RELEASEDATE" "OpenLDAP LDVERSION"
 .SH NAME
@@ -23,6 +23,12 @@ resets, acceptable password content, and even grace logins.
 Different groups of users may be associated with different password
 policies, and there is no limit to the number of password policies
 that may be created.
+.P
+Note that some of the policies do not take effect when the operation
+is performed with the
+.B rootdn
+identity; all the operations, when performed with any other identity,
+may be subjected to constraints, like access control.
 
 .SH CONFIGURATION
 These 
@@ -39,9 +45,11 @@ and no default is given, then no policies will be enforced.
 .TP
 .B ppolicy_hash_cleartext
 Specify that cleartext passwords present in Add and Modify requests should
-be hashed before being stored in the database. This violates the X.500
+be hashed before being stored in the database. This violates the X.500/LDAP
 information model, but may be needed to compensate for LDAP clients that
-don't use the Password Modify exop to manage passwords.
+don't use the Password Modify extended operation to manage passwords.  It
+is recommended that when this option is used that compare, search, and
+read access be denied to all directory users. 
 .TP
 .B ppolicy_use_lockout
 A client will always receive an LDAP
@@ -124,7 +132,7 @@ Note: in this implementation, the only
 value accepted for
 .B pwdAttribute
 is
-.RI " userPassword ".
+.IR " userPassword ".
 .LP
 .RS 4
 (  1.3.6.1.4.1.42.2.27.8.1.1
@@ -173,6 +181,9 @@ attribute is not present, or if its value is
 zero (0), used passwords will not be stored in
 .B pwdHistory
 and thus any previously-used password may be reused.
+No history checking occurs if the password is being modified by the
+.BR rootdn ,
+although the password is saved in the history.
 .LP
 .RS 4
 (  1.3.6.1.4.1.42.2.27.8.1.4
@@ -517,6 +528,7 @@ policy rules will be enforced.
    EQUALITY distinguishedNameMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
    SINGLE-VALUE
+   NO-USER-MODIFICATION
    USAGE directoryOperation)
 .RE
 
@@ -537,6 +549,7 @@ does not exist, the user's password will not expire.
    EQUALITY generalizedTimeMatch
    ORDERING generalizedTimeOrderingMatch
    SINGLE-VALUE
+   NO-USER-MODIFICATION
    USAGE directoryOperation)
 .RE
 
@@ -557,6 +570,7 @@ and may only be unlocked by an administrator.
    EQUALITY generalizedTimeMatch
    ORDERING generalizedTimeOrderingMatch
    SINGLE-VALUE
+   NO-USER-MODIFICATION
    USAGE directoryOperation)
 .RE
 
@@ -590,6 +604,7 @@ will be cleansed of entries.
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
    EQUALITY generalizedTimeMatch
    ORDERING generalizedTimeOrderingMatch
+   NO-USER-MODIFICATION
    USAGE directoryOperation )
 .RE
 
@@ -643,14 +658,14 @@ field is in GMT format.
    DESC 'The history of user passwords'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
    EQUALITY octetStringMatch
+   NO-USER-MODIFICATION
    USAGE directoryOperation)
 .RE
 
 .B pwdGraceUseTime
 This attribute contains the list of timestamps of logins made after
 the user password in the DN has expired.  These post-expiration
-logins are known as
-.RI " "grace logins" ."
+logins are known as "\fIgrace logins\fP".
 If too many
 .I grace logins
 have been used (please refer to the
@@ -667,6 +682,7 @@ attribute.
    DESC 'The timestamps of the grace login once the password has expired'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
    EQUALITY generalizedTimeMatch
+   NO-USER-MODIFICATION
    USAGE directoryOperation)
 .RE
 
@@ -712,7 +728,7 @@ ppolicy_default "cn=Standard,ou=Policies,dc=example,dc=com"
 .LP
 IETF LDAP password policy proposal by P. Behera, L.  Poitou and J.
 Sermersheim:  documented in IETF document
-"draft-behera-ldap-password-policy-08.txt".
+"draft-behera-ldap-password-policy-09.txt".
 
 .SH BUGS
 The LDAP Password Policy specification is not yet an approved standard,
@@ -731,8 +747,8 @@ IETF LDAP password policy proposal by P. Behera, L.
 Poitou and J. Sermersheim.
 The proposal is fully documented in
 the
-IETF document named draft-behera-ldap-password-policy-08.txt,
-written in October of 2004.
+IETF document named draft-behera-ldap-password-policy-09.txt,
+written in July of 2005.
 .P
 .B OpenLDAP
 is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).