[389-users] Re: shadowexpire attribute on 389-ds-base-1.3.5.10-12.el7_3.x86_64

On Thu, 2017-01-05 at 15:09 -0800, Gordon Messmer wrote:
> After upgrading to CentOS 7.3, I found that shadowExpire attributes were
> not returned correctly. Searching for an account shows:
>
> dn: UID=gmessmer,ou=People,dc=...
> uid: gmessmer
> shadowexpire: 117170
>
> The same value is shown in the 389-ds console. The correct value,
> however, appears in our daily LDIF exports. After downgrading to
> 389-ds-base-1.3.4.0-33.el7_2.x86_64, the value appears correctly in
> searches again:
>
> dn: UID=gmessmer,ou=People,dc=...
> uid: gmessmer
> shadowexpire: 17248
>

The shadowexpire value now is handled differently on 1.3.5 if I recall.

Instead of being "set" by you to a value, it's now calculated and
derived from the ns password policy. As the account nears expiry, the
values decrements.

When you export the DB with the ldif, you are bypassing the calculation
code, and you get what's stored in the DB.

I hope that helps you see why the values are changing. Your best path
forward is to work on and resolve the password policy configuration of
your system.


--
Sincerely,

William Brown
Software Engineer
Red Hat, Brisbane