From 37f5c6aa0e2b99f86e23e0f392e993a05c48dd1a Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Tue, 23 Aug 2005 19:24:35 +0000 Subject: [PATCH] Update for draft 09 (just added NO-USER-MODIFICATION to some operational attributes). --- .../draft-behera-ldap-password-policy-xx.txt | 781 +++++++++++------- doc/man/man5/slapo-ppolicy.5 | 12 +- 2 files changed, 485 insertions(+), 308 deletions(-) diff --git a/doc/drafts/draft-behera-ldap-password-policy-xx.txt b/doc/drafts/draft-behera-ldap-password-policy-xx.txt index d9978abe04..3e61917ef2 100644 --- a/doc/drafts/draft-behera-ldap-password-policy-xx.txt +++ b/doc/drafts/draft-behera-ldap-password-policy-xx.txt @@ -1,27 +1,28 @@ + + + Network Working Group J. Sermersheim Internet-Draft Novell, Inc -Expires: April 24, 2005 L. Poitou +Expires: January 18, 2006 L. Poitou Sun Microsystems - October 24, 2004 + July 17, 2005 Password Policy for LDAP Directories - draft-behera-ldap-password-policy-08.txt + draft-behera-ldap-password-policy-09.txt Status of this Memo - This document is an Internet-Draft and is subject to all provisions - of section 3 of RFC 3667. By submitting this Internet-Draft, each - author represents that any applicable patent or other IPR claims of - which he or she is aware have been or will be disclosed, and any of - which he or she become aware will be disclosed, in accordance with - RFC 3668. + By submitting this Internet-Draft, each author represents that any + applicable patent or other IPR claims of which he or she is aware + have been or will be disclosed, and any of which he or she becomes + aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that - other groups may also distribute working documents as - Internet-Drafts. + other groups may also distribute working documents as Internet- + Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any @@ -34,11 +35,11 @@ Status of this Memo The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. - This Internet-Draft will expire on April 24, 2005. + This Internet-Draft will expire on January 18, 2006. Copyright Notice - Copyright (C) The Internet Society (2004). + Copyright (C) The Internet Society (2005). Abstract @@ -48,15 +49,15 @@ Abstract improve the security of LDAP directories and make it difficult for password cracking programs to break into directories, it is desirable to enforce a set of rules on password usage. These rules are made to + ensure that users change their passwords periodically, passwords meet -Sermersheim & Poitou Expires April 24, 2005 [Page 1] +Sermersheim & Poitou Expires January 18, 2006 [Page 1] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 - ensure that users change their passwords periodically, passwords meet construction requirements, the re-use of old password is restricted, and users are locked out after a certain number of failed attempts. @@ -66,55 +67,9 @@ Discussion Forum LDAP Extensions mailing list . Please send editorial comments directly to the authors. -Table of Contents - 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 - 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 5 - 3. Application of password policy . . . . . . . . . . . . . . . . 6 - 4. Articles of password policy . . . . . . . . . . . . . . . . . 7 - 4.1 Password Usage Policy . . . . . . . . . . . . . . . . . . . . 7 - 4.2 Password Modification Policy . . . . . . . . . . . . . . . . . 7 - 4.3 Restriction of the Password Policy . . . . . . . . . . . . . . 10 - 5. Schema used for Password Policy . . . . . . . . . . . . . . . 11 - 5.1 The pwdPolicy Object Class . . . . . . . . . . . . . . . . . . 11 - 5.2 Attribute Types used in the pwdPolicy ObjectClass . . . . . . 11 - 5.3 Attribute Types for Password Policy State Information . . . . 16 - 6. Controls used for Password Policy . . . . . . . . . . . . . . 20 - 6.1 Request Control . . . . . . . . . . . . . . . . . . . . . . . 20 - 6.2 Response Control . . . . . . . . . . . . . . . . . . . . . . . 20 - 7. Policy Decision Points . . . . . . . . . . . . . . . . . . . . 22 - 7.1 Locked Account Check . . . . . . . . . . . . . . . . . . . . . 22 - 7.2 Password Must be Changed Now Check . . . . . . . . . . . . . . 22 - 7.3 Password Expiration Check . . . . . . . . . . . . . . . . . . 22 - 7.4 Remaining Grace AuthN Check . . . . . . . . . . . . . . . . . 22 - 7.5 Time Before Expiration Check . . . . . . . . . . . . . . . . . 23 - 7.6 Intruder Detection Check . . . . . . . . . . . . . . . . . . . 23 - 7.7 Password Too Young Check . . . . . . . . . . . . . . . . . . . 23 - 8. Server Policy Enforcement Points . . . . . . . . . . . . . . . 24 - 8.1 Password-based Authentication . . . . . . . . . . . . . . . . 24 - 8.2 Password Update Operations . . . . . . . . . . . . . . . . . . 26 - 8.3 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 29 - 9. Client Policy Enforcement Points . . . . . . . . . . . . . . . 30 - 9.1 Bind Operation . . . . . . . . . . . . . . . . . . . . . . . . 30 - 9.2 Modify Operations . . . . . . . . . . . . . . . . . . . . . . 30 - 9.3 Add Operation . . . . . . . . . . . . . . . . . . . . . . . . 31 - 9.4 Compare Operation . . . . . . . . . . . . . . . . . . . . . . 32 - 9.5 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 32 - 10. Administration of the Password Policy . . . . . . . . . . . . 33 - 11. Password Policy and Replication . . . . . . . . . . . . . . . 34 - 12. Security Considerations . . . . . . . . . . . . . . . . . . . 35 - 13. Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . 36 - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 2] - -Internet-Draft Password Policy for LDAP Directories October 2004 - 14. Normative References . . . . . . . . . . . . . . . . . . . . . 36 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 37 - Intellectual Property and Copyright Statements . . . . . . . . 38 @@ -154,6 +109,53 @@ Internet-Draft Password Policy for LDAP Directories October 2004 +Sermersheim & Poitou Expires January 18, 2006 [Page 2] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + +Table of Contents + + 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 + 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 5 + 3. Application of password policy . . . . . . . . . . . . . . . . 6 + 4. Articles of password policy . . . . . . . . . . . . . . . . . 7 + 4.1 Password Usage Policy . . . . . . . . . . . . . . . . . . . . 7 + 4.2 Password Modification Policy . . . . . . . . . . . . . . . . . 7 + 4.3 Restriction of the Password Policy . . . . . . . . . . . . . . 10 + 5. Schema used for Password Policy . . . . . . . . . . . . . . . 11 + 5.1 The pwdPolicy Object Class . . . . . . . . . . . . . . . . . . 11 + 5.2 Attribute Types used in the pwdPolicy ObjectClass . . . . . . 11 + 5.3 Attribute Types for Password Policy State Information . . . . 16 + 6. Controls used for Password Policy . . . . . . . . . . . . . . 21 + 6.1 Request Control . . . . . . . . . . . . . . . . . . . . . . . 21 + 6.2 Response Control . . . . . . . . . . . . . . . . . . . . . . . 21 + 7. Policy Decision Points . . . . . . . . . . . . . . . . . . . . 23 + 7.1 Locked Account Check . . . . . . . . . . . . . . . . . . . . . 23 + 7.2 Password Must be Changed Now Check . . . . . . . . . . . . . . 23 + 7.3 Password Expiration Check . . . . . . . . . . . . . . . . . . 23 + 7.4 Remaining Grace AuthN Check . . . . . . . . . . . . . . . . . 23 + 7.5 Time Before Expiration Check . . . . . . . . . . . . . . . . . 24 + 7.6 Intruder Detection Check . . . . . . . . . . . . . . . . . . . 24 + 7.7 Password Too Young Check . . . . . . . . . . . . . . . . . . . 24 + 8. Server Policy Enforcement Points . . . . . . . . . . . . . . . 25 + 8.1 Password-based Authentication . . . . . . . . . . . . . . . . 25 + 8.2 Password Update Operations . . . . . . . . . . . . . . . . . . 27 + 8.3 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 30 + 9. Client Policy Enforcement Points . . . . . . . . . . . . . . . 31 + 9.1 Bind Operation . . . . . . . . . . . . . . . . . . . . . . . . 31 + 9.2 Modify Operations . . . . . . . . . . . . . . . . . . . . . . 32 + 9.3 Add Operation . . . . . . . . . . . . . . . . . . . . . . . . 33 + 9.4 Compare Operation . . . . . . . . . . . . . . . . . . . . . . 33 + 9.5 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 34 + 10. Administration of the Password Policy . . . . . . . . . . . . 35 + 11. Password Policy and Replication . . . . . . . . . . . . . . . 36 + 12. Security Considerations . . . . . . . . . . . . . . . . . . . 37 + 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 38 + 14. Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . 39 + 15. Normative References . . . . . . . . . . . . . . . . . . . . . 39 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 40 + Intellectual Property and Copyright Statements . . . . . . . . 41 @@ -163,9 +165,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 3] +Sermersheim & Poitou Expires January 18, 2006 [Page 3] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 1. Overview @@ -181,7 +183,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 other things, this policy includes: o Whether and when passwords expire. + o Whether failed bind attempts cause the account to be locked. + o If and how users are able to change their passwords. In order to achieve greater security protection and ensure @@ -217,11 +221,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - -Sermersheim & Poitou Expires April 24, 2005 [Page 4] +Sermersheim & Poitou Expires January 18, 2006 [Page 4] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 2. Conventions @@ -275,9 +277,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 5] +Sermersheim & Poitou Expires January 18, 2006 [Page 5] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 3. Application of password policy @@ -331,9 +333,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 6] +Sermersheim & Poitou Expires January 18, 2006 [Page 6] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 4. Articles of password policy @@ -353,19 +355,24 @@ Internet-Draft Password Policy for LDAP Directories October 2004 4.1.1 Password Guessing Limit In order to prevent intruders from guessing a user's password, a - mechanism exists to track the number of failed authentication - attempts, and take action when a limit is reached. This policy - consists of five parts: + mechanism exists to track the number of consecutive failed + authentication attempts, and take action when a limit is reached. + This policy consists of five parts: o A configurable limit on failed authentication attempts. + o A counter to track the number of failed authentication attempts. + o A timeframe in which the limit of consecutive failed authentication attempts must happen before action is taken. + o The action to be taken when the limit is reached. The action will either be nothing, or the account will be locked. + o An amount of time the account is locked (if it is to be locked). This can be indefinite. + 4.2 Password Modification Policy This section describes policy enforced while users are modifying @@ -377,20 +384,22 @@ Internet-Draft Password Policy for LDAP Directories October 2004 password attribute during an add or modify operation, but MAY be done by other means such as an extended operation. -4.2.1 Password Expiration, Expiration Warning, and Grace - Authentications - One of the key properties of a password is the fact that it is not - well known. If a password is frequently changed, the chances of that - user's account being broken into are minimized. -Sermersheim & Poitou Expires April 24, 2005 [Page 7] +Sermersheim & Poitou Expires January 18, 2006 [Page 7] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + + +4.2.1 Password Expiration, Expiration Warning, and Grace + Authentications + One of the key properties of a password is the fact that it is not + well known. If a password is frequently changed, the chances of that + user's account being broken into are minimized. Password policy administrators may deploy a password policy that causes passwords to expire after a given amount of time - thus @@ -404,11 +413,13 @@ Internet-Draft Password Policy for LDAP Directories October 2004 o A warning may be returned to the user sometime before his password is due to expire. If the user fails to heed this warning before the expiration time, his account will be locked. + o The user may bind to the directory a preset number of times after her password has expired. If she fails to change her password during one of her 'grace' authentications, her account will be locked. + 4.2.2 Password History When the Password Expiration policy is used, an additional mechanism @@ -431,6 +442,14 @@ Internet-Draft Password Policy for LDAP Directories October 2004 This process may be made less attractive to users by employing a minimum age for passwords. If users are forced to wait 24 hours + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 8] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + between password changes, they may be less likely to cycle through a history of 10 passwords. @@ -440,21 +459,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 are easy to guess, a password quality policy may be employed. This policy consists of two general mechanisms - ensuring that passwords conform to a defined quality criterion and ensuring that they are of - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 8] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - a minimum length. Forcing a password to comply with the quality policy may imply a variety of things including: o Disallowing trivial or well-known words make up the password. + o Forcing a certain number of digits be used. + o Disallowing anagrams of the user's name. The implementation of this policy meets with the following problems: @@ -463,19 +476,18 @@ Internet-Draft Password Policy for LDAP Directories October 2004 before being sent, the server has no way of enforcing this policy. Therefore, the onus of enforcing this policy falls upon client implementations. + o There are no specific definitions of what 'quality checking' means. This can lead to unexpected behavior in a heterogeneous environment. + 4.2.5 User Defined Passwords In some cases, it is desirable to disallow users from adding and updating their own passwords. This policy makes this functionality possible. - This implies that certain other policy, such as password expiration - is not enforced. - 4.2.6 Password Change after Reset This policy forces the user to update her password after it has been @@ -485,6 +497,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 This is needed in scenarios where a password administrator has set or reset the password to a well-known value. + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 9] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 4.2.7 Safe Modification As directories become more commonly used, it will not be unusual for @@ -496,16 +517,11 @@ Internet-Draft Password Policy for LDAP Directories October 2004 This policy forces the user to prove his identity by specifying the old password during a password modify operation. - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 9] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - {TODO: This allows a dictionary attack unless we specify that this is - also subject to intruder detection} + also subject to intruder detection. One solution is to require users + to authN prior to changing password. Another solution is to perform + intruder detection checks when the password for a non-authenticated + identity is being updated} 4.3 Restriction of the Password Policy @@ -541,23 +557,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - - - - - - - - - - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 10] +Sermersheim & Poitou Expires January 18, 2006 [Page 10] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 5. Schema used for Password Policy @@ -585,6 +587,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) ) + 5.2 Attribute Types used in the pwdPolicy ObjectClass Following are the attribute types used by the pwdPolicy object class. @@ -600,27 +603,28 @@ Internet-Draft Password Policy for LDAP Directories October 2004 EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) + 5.2.2 pwdMinAge This attribute holds the number of seconds that must elapse between modifications to the password. If this attribute is not present, 0 seconds is assumed. - ( 1.3.6.1.4.1.42.2.27.8.1.2 - -Sermersheim & Poitou Expires April 24, 2005 [Page 11] +Sermersheim & Poitou Expires January 18, 2006 [Page 11] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + ( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.3 pwdMaxAge This attribute holds the number of seconds after which a modified @@ -636,6 +640,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.4 pwdInHistory This attribute specifies the maximum number of used passwords stored @@ -651,27 +656,28 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.5 pwdCheckQuality {TODO: Consider changing the syntax to OID. Each OID will list a quality rule (like min len, # of special characters, etc). These - rules can be specified outsid ethis document.} + rules can be specified outside this document.} {TODO: Note that even though this is meant to be a check that happens during password modification, it may also be allowed to happen during authN. This is useful for situations where the password is encrypted - when modified, but decrypted when used to authN.} - - This attribute indicates how the password quality will be verified - while being modified or added. If this attribute is not present, or -Sermersheim & Poitou Expires April 24, 2005 [Page 12] +Sermersheim & Poitou Expires January 18, 2006 [Page 12] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + when modified, but decrypted when used to authN.} + + This attribute indicates how the password quality will be verified + while being modified or added. If this attribute is not present, or if the value is '0', quality checking will not be enforced. A value of '1' indicates that the server will check the quality, and if the server is unable to check it (due to a hashed password or other @@ -685,6 +691,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.6 pwdMinLength When quality checking is enabled, this attribute holds the minimum @@ -701,6 +708,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.7 pwdExpireWarning This attribute specifies the maximum number of seconds before a @@ -714,20 +722,21 @@ Internet-Draft Password Policy for LDAP Directories October 2004 ( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 - SINGLE-VALUE ) -5.2.8 pwdGraceAuthNLimit - This attribute specifies the number of times an expired password can +Sermersheim & Poitou Expires January 18, 2006 [Page 13] + +Internet-Draft Password Policy for LDAP Directories July 2005 -Sermersheim & Poitou Expires April 24, 2005 [Page 13] - -Internet-Draft Password Policy for LDAP Directories October 2004 + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE-VALUE ) + +5.2.8 pwdGraceAuthNLimit + This attribute specifies the number of times an expired password can be used to authenticate. If this attribute is not present or if the value is 0, authentication will fail. @@ -737,6 +746,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.9 pwdLockout This attribute indicates, when its value is "TRUE", that the password @@ -754,6 +764,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + 5.2.10 pwdLockoutDuration This attribute holds the number of seconds that the password cannot @@ -768,6 +779,13 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + + +Sermersheim & Poitou Expires January 18, 2006 [Page 14] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 5.2.11 pwdMaxFailure This attribute specifies the number of consecutive failed bind @@ -775,21 +793,13 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If this attribute is not present, or if the value is 0, this policy is not checked, and the value of pwdLockout will be ignored. - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 14] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - ( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.12 pwdFailureCountInterval This attribute holds the number of seconds after which the password @@ -805,6 +815,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.13 pwdMustChange This attribute specifies with a value of "TRUE" that users must @@ -822,6 +833,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 15] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 5.2.14 pwdAllowUserChange This attribute indicates whether users can change their own @@ -831,20 +851,12 @@ Internet-Draft Password Policy for LDAP Directories October 2004 access control mechanism. ( 1.3.6.1.4.1.42.2.27.8.1.14 - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 15] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - NAME 'pwdAllowUserChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + 5.2.15 pwdSafeModify This attribute specifies whether or not the existing password must be @@ -857,6 +869,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + 5.3 Attribute Types for Password Policy State Information Password policy state information must be maintained for each user. @@ -878,6 +891,13 @@ Internet-Draft Password Policy for LDAP Directories October 2004 (1.3.6.1.4.1.1466.115.121.1.38). The attribute type descriptor (short name) MUST be used. + + +Sermersheim & Poitou Expires January 18, 2006 [Page 16] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + For example, if the pwdPolicy object has for pwdAttribute "userPassword" then the pwdChangedTime operational attribute, in a user entry, will be: @@ -889,13 +909,6 @@ Internet-Draft Password Policy for LDAP Directories October 2004 operation, and does not specify an option, all subtypes of that policy state attribute are returned. - - -Sermersheim & Poitou Expires April 24, 2005 [Page 16] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - 5.3.2 pwdChangedTime This attribute specifies the last time the entry's password was @@ -909,8 +922,10 @@ Internet-Draft Password Policy for LDAP Directories October 2004 ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation ) + 5.3.3 pwdAccountLockedTime This attribute holds the time that the user's account was locked. A @@ -926,8 +941,19 @@ Internet-Draft Password Policy for LDAP Directories October 2004 ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation ) + + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 17] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 5.3.4 pwdFailureTime This attribute holds the timestamps of the consecutive authentication @@ -940,18 +966,10 @@ Internet-Draft Password Policy for LDAP Directories October 2004 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + NO-USER-MODIFICATION USAGE directoryOperation ) - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 17] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - 5.3.5 pwdHistory This attribute holds a history of previously used passwords. Values @@ -984,10 +1002,20 @@ Internet-Draft Password Policy for LDAP Directories October 2004 ( 1.3.6.1.4.1.42.2.27.8.1.20 NAME 'pwdHistory' DESC 'The history of user s passwords' + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 18] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 + NO-USER-MODIFICATION USAGE directoryOperation ) + 5.3.6 pwdGraceUseTime This attribute holds the timestamps of grace authentications after a @@ -999,22 +1027,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 password has expired' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 18] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - + NO-USER-MODIFICATION USAGE directoryOperation ) + 5.3.7 pwdReset This attribute holds a flag to indicate (when TRUE) that the password has been updated by the password administrator and must be changed by - the user on first authentication. + the user. ( 1.3.6.1.4.1.42.2.27.8.1.22 NAME 'pwdReset' @@ -1024,6 +1045,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SINGLE-VALUE USAGE directoryOperation ) + 5.3.8 pwdPolicySubentry This attribute points to the pwdPolicy subentry in effect for this @@ -1035,6 +1057,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE + NO-USER-MODIFICATION + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 19] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + USAGE directoryOperation ) @@ -1059,9 +1090,36 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 19] + + + + + + + + + + + + + + + + + + + + + + + + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 20] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 6. Controls used for Password Policy @@ -1072,6 +1130,8 @@ Internet-Draft Password Policy for LDAP Directories October 2004 response control contains various warnings and errors associated with password policy. + {TODO: add a note about advertisement and discovery} + 6.1 Request Control This control MAY be sent with any LDAP request message in order to @@ -1110,16 +1170,16 @@ Internet-Draft Password Policy for LDAP Directories October 2004 passwordInHistory (8) } OPTIONAL } The timeBeforeExpiration warning specifies the number of seconds - before a password will expire. The graceAuthNsRemaining warning - specifies the remaining number of times a user will be allowed to -Sermersheim & Poitou Expires April 24, 2005 [Page 20] +Sermersheim & Poitou Expires January 18, 2006 [Page 21] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + before a password will expire. The graceAuthNsRemaining warning + specifies the remaining number of times a user will be allowed to authenticate with an expired password. The passwordExpired error signifies that the password has expired and must be reset. The changeAfterReset error signifies that the password must be changed @@ -1169,11 +1229,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - -Sermersheim & Poitou Expires April 24, 2005 [Page 21] +Sermersheim & Poitou Expires January 18, 2006 [Page 22] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 7. Policy Decision Points @@ -1193,6 +1251,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 if any of these conditions are met: o The value of the pwdAccountLockedTime attribute is 000001010000Z. + o The current time is less than the value of the pwdAccountLockedTime attribute added to the value of the pwdLockoutDuration. @@ -1205,6 +1264,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 if all of these conditions are met: The pwdMustChange attribute is set to TRUE. + The pwdReset attribute is set to TRUE. Otherwise a status of false is returned. @@ -1212,9 +1272,8 @@ Internet-Draft Password Policy for LDAP Directories October 2004 7.3 Password Expiration Check A status of true is returned indicating that the password has expired - if the value of the pwdExpireWarning attribute is 0, and the current - time minus the value of pwdChangedTime is greater than the value of - the pwdMaxAge. + if the current time minus the value of pwdChangedTime is greater than + the value of the pwdMaxAge. Otherwise, a status of false is returned. @@ -1223,15 +1282,16 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the pwdGraceUseTime attribute is present, the number of values in that attribute subtracted from the value of pwdGraceAuthNLimit is returned. Otherwise zero is returned. A positive result specifies - the number of remaining grace authentications. -Sermersheim & Poitou Expires April 24, 2005 [Page 22] +Sermersheim & Poitou Expires January 18, 2006 [Page 23] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + the number of remaining grace authentications. + 7.5 Time Before Expiration Check If the pwdExpireWarning attribute is not present a zero status is @@ -1251,6 +1311,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 returned if the following conditions are met: The pwdLockout attribute is TRUE. + The number of values in the pwdFailureTime attribute that are younger than pwdFailureCountInterval is greater or equal to the pwdMaxFailure attribute. @@ -1266,6 +1327,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 password was last updated is returned if: The value of pwdMinAge is non-zero and pwdChangedTime is present. + The value of pwdMinAge is greater than the current time minus the value of pwdChangedTime. @@ -1279,13 +1341,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 23] +Sermersheim & Poitou Expires January 18, 2006 [Page 24] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 8. Server Policy Enforcement Points @@ -1309,7 +1367,10 @@ Internet-Draft Password Policy for LDAP Directories October 2004 updates used while validating a password. Operations that validate passwords include, but are not limited to, the Bind operation where the simple choice specifies a password, and the compare operation - where the attribute being compared holds a password. + where the attribute being compared holds a password. Note that while + the compare operation does not authenticate a user to the LDAP + server, it may be used by an external application for purposes of + authentication. 8.1.1 Fail if the account is locked @@ -1320,9 +1381,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 the error: accountLocked (1) in the passwordPolicyResponse in the controls field of the message. -8.1.2 AuthN Passed Procedures +8.1.2 Validated Password Procedures - If the authentication process indicates that the password validated, + If the validation operation indicates that the password validated, these procedures are followed in order: 8.1.2.1 Policy state updates @@ -1333,17 +1394,18 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the decision in Section 7.2 returns true, the server sends to the client a response with an appropriate successful resultCode (i.e. - success (0), compareTrue (6), etc.), and includes the - passwordPolicyResponse in the controls field of the bindResponse - message with the warning: changeAfterReset specified. -Sermersheim & Poitou Expires April 24, 2005 [Page 24] +Sermersheim & Poitou Expires January 18, 2006 [Page 25] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + success (0), compareTrue (6), etc.), and includes the + passwordPolicyResponse in the controls field of the bindResponse + message with the warning: changeAfterReset specified. + For bind, the server MUST then disallow all operations issued by this user except modify password, bind, unbind, abandon and StartTLS extended operation. @@ -1359,7 +1421,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If there are remaining grace authentications as per Section 7.4, the server adds a new value with the current time in pwdGraceUseTime. Then it sends to the client a response with an appropriate successful - resultCode (i.e. success (0), compareTrue (6), etc.), and includes + resultCode (i.e. success (0), compareTrue (6), etc.), and includes the passwordPolicyResponse in the controls field of the response message with the warning: graceAuthNsRemaining choice set to the number of grace authentications left. @@ -1382,23 +1444,24 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the result of Section 7.5 is a positive number, the server sends to the client a response with an appropriate successful resultCode - (i.e. success (0), compareTrue (6), etc.), and includes the + (i.e. success (0), compareTrue (6), etc.), and includes the passwordPolicyResponse in the controls field of the bindResponse message with the warning: timeBeforeExiration set to the value as described above. Otherwise, the server sends a successful response, and omits the passwordPolicyResponse. -8.1.2.5 AuthN Failed Procedures - If the authentication process indicates that the password failed - validation due to invalid credentials, these procedures are followed: - -Sermersheim & Poitou Expires April 24, 2005 [Page 25] +Sermersheim & Poitou Expires January 18, 2006 [Page 26] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + + +8.1.2.5 AuthN Failed Procedures + If the authentication process indicates that the password failed + validation due to invalid credentials, these procedures are followed: 8.1.2.5.1 Policy state update @@ -1438,23 +1501,24 @@ Internet-Draft Password Policy for LDAP Directories October 2004 When the LDAP modify operation is used to modify a password, this is done by specifying both a delete action and an add or replace action, - where the delete action is first, and specifies the existing - password, and the add or replace action specifies the new password. - Other password update operations SHOULD employ a similar mechanism. - Otherwise this policy will fail. + where the delete action specifies the existing password, and the add + or replace action specifies the new password. Other password update + operations SHOULD employ a similar mechanism. Otherwise this policy + will fail. - If the existing password is not specified, the server does not - process the operation and sends the appropriate response message to - the client with the resultCode: insufficientAccessRights (50), and - includes the passwordPolicyResponse in the controls field of the - response message with the error: mustSupplyOldPassword (4). -Sermersheim & Poitou Expires April 24, 2005 [Page 26] +Sermersheim & Poitou Expires January 18, 2006 [Page 27] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + + If the existing password is not specified, the server does not + process the operation and sends the appropriate response message to + the client with the resultCode: insufficientAccessRights (50), and + includes the passwordPolicyResponse in the controls field of the + response message with the error: mustSupplyOldPassword (4). 8.2.2 Change After Reset @@ -1498,21 +1562,22 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the value is 1, operation continues. If the value is 2, the server sends a response message to the client with the resultCode: constraintViolation (19), and includes the passwordPolicyResponse - in the controls field of the response message with the error: - insufficientPasswordQuality (5). - If the server is able to check the password quality, and the check - fails, the server sends a response message to the client with the - resultCode: constraintViolation (19), and includes the - passwordPolicyResponse in the controls field of the response -Sermersheim & Poitou Expires April 24, 2005 [Page 27] +Sermersheim & Poitou Expires January 18, 2006 [Page 28] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + in the controls field of the response message with the error: + insufficientPasswordQuality (5). + If the server is able to check the password quality, and the check + fails, the server sends a response message to the client with the + resultCode: constraintViolation (19), and includes the + passwordPolicyResponse in the controls field of the response message with the error: insufficientPasswordQuality (5). + o checks the value of the pwdMinLength attribute. If the value is non-zero, it ensures that the new password is of at least the minimum length. @@ -1529,6 +1594,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 passwordPolicyResponse in the controls field of the response message with the error: passwordTooShort (6). + 8.2.6 Invalid Reuse If pwdInHistory is present and its value is non-zero, the server @@ -1552,6 +1618,14 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the value of pwdInHistory is non-zero, the server adds the previous password (if one existed) to the pwdHistory attribute. If + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 29] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + the number of attributes held in the pwdHistory attribute exceeds the value of pwdInHistory, the server removes the oldest excess passwords. @@ -1561,15 +1635,8 @@ Internet-Draft Password Policy for LDAP Directories October 2004 set to TRUE. Otherwise, the pwdReset is removed from the user's entry if it exists. - - -Sermersheim & Poitou Expires April 24, 2005 [Page 28] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - - The pwdFailureTime, pwdGraceUseTime and pwdExpirationWarned - attributes is removed from the user's entry if they exist. + The pwdFailureTime and pwdGraceUseTime attributes is removed from the + user's entry if they exist. 8.3 Other Operations @@ -1610,18 +1677,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - - - - - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 29] +Sermersheim & Poitou Expires January 18, 2006 [Page 30] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 9. Client Policy Enforcement Points @@ -1648,38 +1706,44 @@ Internet-Draft Password Policy for LDAP Directories October 2004 failure limit has been reached and the account is locked. The user needs to retry later or contact the password administrator to reset the password. + o bindResponse.resultCode = success (0), passwordPolicyResponse.error = changeAfterReset (2): The user is binding for the first time after the password administrator set the password. In this scenario, the client SHOULD prompt the user to change his password immediately. + o bindResponse.resultCode = success (0), passwordPolicyResponse.warning = graceAuthNsRemaining: The password has expired but there are remaining grace authentications. The user needs to change it. + o bindResponse.resultCode = invalidCredentials (49), passwordPolicyResponse.error = passwordExpired (0): The password has expired and there are no more grace authentications. The user contacts the password administrator in order to have its password reset. + o bindResponse.resultCode = success (0), passwordPolicyResponse.warning = timeBeforeExpiration: The user's password will expire in n number of seconds. -9.2 Modify Operations -9.2.1 Modify Request - If the application or client encrypts the password prior to sending - it in a password modification operation (whether done through -Sermersheim & Poitou Expires April 24, 2005 [Page 30] +Sermersheim & Poitou Expires January 18, 2006 [Page 31] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 +9.2 Modify Operations + +9.2.1 Modify Request + + If the application or client encrypts the password prior to sending + it in a password modification operation (whether done through modifyRequest or another password modification mechanism), it SHOULD check the values of the pwdMinLength, and pwdCheckQuality attributes and SHOULD enforce these policies. @@ -1698,25 +1762,38 @@ Internet-Draft Password Policy for LDAP Directories October 2004 passwordPolicyResponse.error = mustSupplyOldPassword (4): The user attempted to change her password without specifying the old password but the password policy requires this. + o .resultCode = insufficientAccessRights (50), passwordPolicyResponse.error = changeAfterReset (2): The user must change her password before submitting any other LDAP requests. + o .resultCode = insufficientAccessRights (50), passwordPolicyResponse.error = passwordModNotAllowed (3): The user doesn't have sufficient rights to change his password. + o .resultCode = constraintViolation (19), passwordPolicyResponse.error = passwordTooYoung (7): It is too soon after the last password modification to change the password. + o .resultCode = constraintViolation (19), passwordPolicyResponse.error = insufficientPasswordQuality (5): The password failed quality checking. + o .resultCode = constraintViolation (19), passwordPolicyResponse.error = passwordTooShort (6): The length of the password is too short. + o .resultCode = constraintViolation (19), passwordPolicyResponse.error = passwordInHistory (8): The password has already been used; the user must choose a different one. + + +Sermersheim & Poitou Expires January 18, 2006 [Page 32] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 9.3 Add Operation If a password is specified in an addRequest, the client checks the @@ -1728,21 +1805,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 passwordPolicyResponse.error = passwordModNotAllowed (3): The user doesn't have sufficient rights to add this password. - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 31] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - o addResponse.resultCode = constraintViolation (19), passwordPolicyResponse.error = insufficientPasswordQuality (5): The password failed quality checking. + o addResponse.resultCode = constraintViolation (19), passwordPolicyResponse.error = passwordTooShort (6): The length of the password is too short. + 9.4 Compare Operation When a compare operation is used to compare a password, the client @@ -1756,18 +1827,29 @@ Internet-Draft Password Policy for LDAP Directories October 2004 failure limit has been reached and the account is locked. The user needs to retry later or contact the password administrator to reset the password. + o compareResponse.resultCode = compareTrue (6), passwordPolicyResponse.warning = graceAuthNsRemaining: The password has expired but there are remaining grace authentications. The user needs to change it. + o compareResponse.resultCode = compareFalse (5), passwordPolicyResponse.error = passwordExpired (0): The password has expired and there are no more grace authentications. The user must contact the password administrator to reset the password. + o compareResponse.resultCode = compareTrue (6), passwordPolicyResponse.warning = timeBeforeExpiration: The user's password will expire in n number of seconds. + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 33] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 9.5 Other Operations For operations other than bind, unbind, abandon or StartTLS, the @@ -1787,9 +1869,41 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 32] + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 34] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 10. Administration of the Password Policy @@ -1843,13 +1957,18 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 33] +Sermersheim & Poitou Expires January 18, 2006 [Page 35] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 11. Password Policy and Replication + {TODO: This section needs to be changed to highlight the pitfals of + replication, sugest some implementation choices to overcome those + pitfals, but remove prescriptive language relating to the update of + state information} + The pwdPolicy object defines the password policy for a portion of the DIT and MUST be replicated on all the replicas of this subtree, as any subentry would be, in order to have a consistent policy among all @@ -1870,11 +1989,11 @@ Internet-Draft Password Policy for LDAP Directories October 2004 doesn't have to be replicated to a read-only replica, since the password will never be directly modified on this server. - The pwdAccountLockedTime, pwdExpirationWarned, pwdFailureTime and - pwdGraceUseTime attributes MUST be replicated to writable replicas, - making the password policy global for all servers. When the user - entry is replicated to a read-only replica, these attributes SHOULD - NOT be replicated. This means that the number of failures, of grace + The pwdAccountLockedTime, pwdFailureTime and pwdGraceUseTime + attributes MUST be replicated to writable replicas, making the + password policy global for all servers. When the user entry is + replicated to a read-only replica, these attributes SHOULD NOT be + replicated. This means that the number of failures, of grace authentications and the locking will take place on each replicated server. For example, the effective number of failed attempts on a user password will be N x M (where N is the number of servers and M @@ -1894,14 +2013,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 34] +Sermersheim & Poitou Expires January 18, 2006 [Page 36] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 12. Security Considerations @@ -1955,38 +2069,94 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 35] +Sermersheim & Poitou Expires January 18, 2006 [Page 37] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + + +13. IANA Considerations + + <<>> + + + + + + + + + + + + + + + + + + + + + + + -13. Acknowledgement + + + + + + + + + + + + + + + + + + + + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 38] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + +14. Acknowledgement This document is based in part on prior work done by Valerie Chu from Netscape Communications Corp, published as draft-vchu-ldap-pwd-policy-00.txt (December 1998). Prasanta Behera participated in early revisions of this document. -14 Normative References +15. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. - [RFC2195] Klensin, J., Catoe, R. and P. Krumviede, "IMAP/POP - AUTHorize Extension for Simple Challenge/Response", RFC - 2195, September 1997. + [RFC2195] Klensin, J., Catoe, R., and P. Krumviede, "IMAP/POP + AUTHorize Extension for Simple Challenge/Response", + RFC 2195, September 1997. [RFC2222] Myers, J., "Simple Authentication and Security Layer (SASL)", RFC 2222, October 1997. - [RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory + [RFC2251] Wahl, M., Howes, T., and S. Kille, "Lightweight Directory Access Protocol (v3)", RFC 2251, December 1997. - [RFC2252] Wahl, M., Coulbeck, A., Howes, T. and S. Kille, + [RFC2252] Wahl, M., Coulbeck, A., Howes, T., and S. Kille, "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997. - [RFC2829] Wahl, M., Alvestrand, H., Hodges, J. and R. Morgan, + [RFC2829] Wahl, M., Alvestrand, H., Hodges, J., and R. Morgan, "Authentication Methods for LDAP", RFC 2829, May 2000. [RFC2831] Leach, P. and C. Newman, "Using Digest Authentication as a @@ -2011,9 +2181,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 36] +Sermersheim & Poitou Expires January 18, 2006 [Page 39] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 Encoding Rules (BER), Canonical Encoding Rules (CER) and @@ -2030,7 +2200,7 @@ Authors' Addresses USA Phone: +1 801 861-3088 - EMail: jimse@novell.com + Email: jimse@novell.com Ludovic Poitou @@ -2040,7 +2210,7 @@ Authors' Addresses France Phone: +33 476 188 212 - EMail: ludovic.poitou@sun.com + Email: ludovic.poitou@sun.com @@ -2067,9 +2237,9 @@ Authors' Addresses -Sermersheim & Poitou Expires April 24, 2005 [Page 37] +Sermersheim & Poitou Expires January 18, 2006 [Page 40] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 Intellectual Property Statement @@ -2110,7 +2280,7 @@ Disclaimer of Validity Copyright Statement - Copyright (C) The Internet Society (2004). This document is subject + Copyright (C) The Internet Society (2005). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. @@ -2123,5 +2293,6 @@ Acknowledgment -Sermersheim & Poitou Expires April 24, 2005 [Page 38] +Sermersheim & Poitou Expires January 18, 2006 [Page 41] + diff --git a/doc/man/man5/slapo-ppolicy.5 b/doc/man/man5/slapo-ppolicy.5 index cc95469adb..7cdb3b6910 100644 --- a/doc/man/man5/slapo-ppolicy.5 +++ b/doc/man/man5/slapo-ppolicy.5 @@ -517,6 +517,7 @@ policy rules will be enforced. EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -537,6 +538,7 @@ does not exist, the user's password will not expire. EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -557,6 +559,7 @@ and may only be unlocked by an administrator. EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -590,6 +593,7 @@ will be cleansed of entries. SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch + NO-USER-MODIFICATION USAGE directoryOperation ) .RE @@ -643,6 +647,7 @@ field is in GMT format. DESC 'The history of user passwords' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 EQUALITY octetStringMatch + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -667,6 +672,7 @@ attribute. DESC 'The timestamps of the grace login once the password has expired' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -712,7 +718,7 @@ ppolicy_default "cn=Standard,ou=Policies,dc=example,dc=com" .LP IETF LDAP password policy proposal by P. Behera, L. Poitou and J. Sermersheim: documented in IETF document -"draft-behera-ldap-password-policy-08.txt". +"draft-behera-ldap-password-policy-09.txt". .SH BUGS The LDAP Password Policy specification is not yet an approved standard, @@ -731,8 +737,8 @@ IETF LDAP password policy proposal by P. Behera, L. Poitou and J. Sermersheim. The proposal is fully documented in the -IETF document named draft-behera-ldap-password-policy-08.txt, -written in October of 2004. +IETF document named draft-behera-ldap-password-policy-09.txt, +written in July of 2005. .P .B OpenLDAP is developed and maintained by The OpenLDAP Project (http://www.openldap.org/). -- 2.39.5