Monday, September 20, 2021

[389-users] Re: ns-newpolicy/pl documentation/use case

On 9/20/21 11:32 AM, Ghiurea, Isabella wrote:

Thank you, so the steps to have this  attribute cfg  and  with set value for each user  are :


-          In DS cfg add attriute PasswordTrackUpddateTime to on, nsslapd-policy-local to on and nsslapd-pwpolicy-inherit –global to on

-          Have users chage their passwd

-          The uid entries wtill display the new attribute :PasswordTrackUpdateTime with time stamp value

Is this sufficient  to have this attribute populate for each DS entry ?


Do I  still need to run this script ?

Do you really need a local subtree policy?  If the password policy you want to use will apply to all your users then you can simplify all of this.  Just set passwordTrackUpdateTime to "on".  That's it. 

If affirmative, I would like to learn when and what arguments must provide at run time ?

Sorry, I'm not sure what you are asking here...






From: Mark Reynolds []
Sent: September 20, 2021 6:01 AM
To: General discussion list for the 389 Directory server project. <>; Ghiurea, Isabella <>
Subject: Re: [389-users] ns-newpolicy/pl documentation/use case


***ATTENTION*** This email originated from outside of the NRC. ***ATTENTION*** Ce courriel provient de l'extérieur du CNRC


On 9/17/21 4:46 PM, Ghiurea, Isabella wrote:

Hi List

I am searching for  some  documentation  for file , as per RH Doc I can  use that script to add the attribute : pwdUpdateTime to each uid  entry after I  already cfg in  DS  Password TrackUpdateTime and  pwdpolicy-  inherit -global  to 'on';

The only docs we have are the official Red Hat docs.  Here's a recap...

This will start to add "pwdUpdateTime" to entries after they change their passwords, but it does not automatically add it to all existing entries.  They must change their passwords after enabling this setting for pwdUpdateTime to be set.

This setting is only used if you are using local password policies (subtree/user policies). It means it will check the global policy settings AND the local policy settings.  Otherwise only the local policy is applied.


Thank you


389-users mailing list --
To unsubscribe send an email to
Fedora Code of Conduct:
List Guidelines:
List Archives:
Do not reply to spam on the list, report it:
Directory Server Development Team
--   Directory Server Development Team

No comments:

Post a Comment