ITS#8565 - Clearly document rootdn requirement for the ppolicy overlay

[openldap] / doc / man / man5 / slapo-ppolicy.5

diff --git a/doc/man/man5/slapo-ppolicy.5 b/doc/man/man5/slapo-ppolicy.5
index be52fa5c3b33a3a38b2984dc4592293458b0b4f2..3fe5184bd43f7cab8f324e119eaa1d7b269519b8 100644 (file)
--- a/doc/man/man5/slapo-ppolicy.5
+++ b/doc/man/man5/slapo-ppolicy.5
@@ -1,5 +1,5 @@
 .TH SLAPO_PPOLICY 5 "RELEASEDATE" "OpenLDAP LDVERSION"
-.\" Copyright 2004-2013 The OpenLDAP Foundation All Rights Reserved.
+.\" Copyright 2004-2017 The OpenLDAP Foundation All Rights Reserved.
 .\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
 .\" $OpenLDAP$
 .SH NAME
@@ -28,7 +28,8 @@ Note that some of the policies do not take effect when the operation
 is performed with the
 .B rootdn
 identity; all the operations, when performed with any other identity,
-may be subjected to constraints, like access control.
+may be subjected to constraints, like access control.  This overlay
+requires a rootdn to be configured on the database.
 .P
 Note that the IETF Password Policy proposal for LDAP makes sense
 when considering a single-valued password attribute, while 
@@ -104,7 +105,7 @@ object class.  The definition of that class is as follows:
         pwdLockout $ pwdLockoutDuration $
         pwdMaxFailure $ pwdFailureCountInterval $
         pwdMustChange $ pwdAllowUserChange $
-        pwdSafeModify ) )
+        pwdSafeModify $ pwdMaxRecordedFailure ) )
 .RE
 
 This implementation also provides an additional
@@ -365,6 +366,25 @@ and
    SINGLE\-VALUE )
 .RE
 
+.B pwdMaxRecordedFailure
+.P
+This attribute contains the maximum number of failed bind
+attempts to store in a user's entry.
+If
+.B pwdMaxRecordedFailure
+is not present, or its value is zero (0), then it defaults
+to the value of
+.BR pwdMaxFailure .
+If that value is also 0, the default is 5.
+.LP
+.RS 4
+(  1.3.6.1.4.1.42.2.27.8.1.16
+   NAME 'pwdMaxRecordedFailure'
+   EQUALITY integerMatch
+   SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+   SINGLE\-VALUE )
+.RE
+
 .B pwdFailureCountInterval
 .P
 This attribute contains the number of seconds after which old
@@ -641,6 +661,8 @@ account may be locked.
 password policy attribute.)
 Excess timestamps beyond those allowed by
 .B pwdMaxFailure
+or
+.B pwdMaxRecordedFailure
 may also be purged.  If a successful authentication is made to this
 DN (i.e. to this user account), then
 .B pwdFailureTime