Sync with HEAD

[openldap] / doc / man / man5 / slapo-ppolicy.5

diff --git a/doc/man/man5/slapo-ppolicy.5 b/doc/man/man5/slapo-ppolicy.5
index 6f2813d4aec7f21bb3b6d92d2b1302e0d6db2d17..929a6e4ce20b224efa184450c7fd404ce00e8f6f 100644 (file)
--- a/doc/man/man5/slapo-ppolicy.5
+++ b/doc/man/man5/slapo-ppolicy.5
@@ -1,7 +1,7 @@
 .\" $OpenLDAP$
-.\" Copyright 2004 The OpenLDAP Foundation All Rights Reserved.
+.\" Copyright 2004-2005 The OpenLDAP Foundation All Rights Reserved.
 .\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
-.TH SLAPD_PPOLICY 5 "RELEASEDATE" "OpenLDAP LDVERSION"
+.TH SLAPO_PPOLICY 5 "RELEASEDATE" "OpenLDAP LDVERSION"
 .SH NAME
 slapo-ppolicy \- Password Policy overlay
 .SH SYNOPSIS
@@ -37,6 +37,12 @@ Specify the DN of the pwdPolicy object to use when no specific policy is
 set on a given user's entry. If there is no specific policy for an entry
 and no default is given, then no policies will be enforced.
 .TP
+.B ppolicy_hash_cleartext
+Specify that cleartext passwords present in Add and Modify requests should
+be hashed before being stored in the database. This violates the X.500
+information model, but may be needed to compensate for LDAP clients that
+don't use the PasswordModify exop to manage passwords.
+.TP
 .B ppolicy_use_lockout
 A client will always receive an LDAP
 .B InvalidCredentials
@@ -69,7 +75,7 @@ object class.  The definition of that class is as follows:
     MAY (
         pwdMinAge $ pwdMaxAge $ pwdInHistory $
         pwdCheckSyntax $ pwdMinLength $
-        pwdExpireWarning $ pwdGraceLoginLimit $
+        pwdExpireWarning $ pwdGraceAuthnLimit $
         pwdLockout $ pwdLockoutDuration $
         pwdMaxFailure $ pwdFailureCountInterval $
         pwdMustChange $ pwdAllowUserChange $
@@ -241,7 +247,7 @@ present, or if the value is zero (0), no warnings will be sent.
    SINGLE-VALUE )
 .RE
 
-.B pwdGraceLoginLimit
+.B pwdGraceAuthnLimit
 .P
 This attribute contains the number of times that an expired password
 may be used to authenticate a user to the directory. If this
@@ -251,7 +257,7 @@ directory.
 .LP
 .RS 4
 (  1.3.6.1.4.1.42.2.27.8.1.8
-   NAME 'pwdGraceLoginLimit'
+   NAME 'pwdGraceAuthnLimit'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE )
@@ -419,7 +425,7 @@ function prototype:
 .RS 4
 int
 .I check_password
-(char *pPasswd, char **ppErrStr, void *pArg);
+(char *pPasswd, char **ppErrStr, Entry *pEntry);
 .RE
 The
 .B pPasswd
@@ -427,9 +433,10 @@ parameter contains the clear-text user password, the
 .B ppErrStr
 parameter contains a double pointer that allows the function
 to return human-readable details about any error it encounters.
-The
-.B pArg
-parameter is currently unused.
+The optional
+.B pEntry
+parameter, if non-NULL, carries a pointer to the
+entry whose password is being checked.
 If
 .B ppErrStr
 is NULL, then 
@@ -441,7 +448,8 @@ indicates that the password is unacceptable.  If the password is
 unacceptable, the server will return an error to the client, and
 .B ppErrStr
 may be used to return a human-readable textual explanation of the
-error.
+error. The error string must be dynamically allocated as it will
+be free()'d by slapd.
 .LP
 .RS 4
 (  1.3.6.1.4.1.4754.1.99.1
@@ -552,28 +560,6 @@ and may only be unlocked by an administrator.
    USAGE directoryOperation)
 .RE
 
-.B pwdExpirationWarned
-.P
-This attribute denotes the time when the first password
-expiration warning was sent to the client regarding this account.
-The amount of time between when this warning is sent and when
-the password actually expires is the amount of time stored in
-the
-.B pwdExpireWarning
-password policy attribute.
-.LP
-.RS 4
-(  1.3.6.1.4.1.42.2.27.8.1.18
-   NAME 'pwdExpirationWarned'
-   DESC 'The time the user was first warned about the
-       coming expiration of their password'
-   SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-   EQUALITY generalizedTimeMatch
-   ORDERING generalizedTimeOrderingMatch
-   SINGLE-VALUE
-   USAGE directoryOperation )
-.RE
-
 .B pwdFailureTime
 .P
 This attribute contains the timestamps of each of the consecutive
@@ -726,7 +712,7 @@ ppolicy_default "cn=Standard,ou=Policies,dc=example,dc=com"
 .LP
 IETF LDAP password policy proposal by P. Behera, L.  Poitou and J.
 Sermersheim:  documented in IETF document
-"draft-behera-ldap-password-policy-07.txt".
+"draft-behera-ldap-password-policy-08.txt".
 
 .SH BUGS
 The LDAP Password Policy specification is not yet an approved standard,
@@ -745,8 +731,8 @@ IETF LDAP password policy proposal by P. Behera, L.
 Poitou and J. Sermersheim.
 The proposal is fully documented in
 the
-IETF document named draft-behera-ldap-password-policy-07.txt,
-written in February of 2004.
+IETF document named draft-behera-ldap-password-policy-08.txt,
+written in October of 2004.
 .P
 .B OpenLDAP
 is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).