Overview#

Password Policy State Information must be maintained for each user.

The information is located in each user entry as a set of operational attributes.

These operational attributes are:

• pwdChangedTime
• pwdAccountLockedTime
• pwdFailureTime
• pwdHistory
• pwdGraceUseTime
• pwdReset
• pwdPolicySubEntry
• pwdStartTime
• pwdEndTime
• pwdLastSuccess

Multiple Passwords#

Since the password policy could apply to several attributes used to store passwords, each of the above operational attributes must have an option to specify which pwdAttribute it applies to. The Password Policy State Attribute provides a method to accommodate Multiple Passwords.

More Information#

There might be more information for this subject on one of the following:

• Draft-behera-ldap-password-policy