= iPlanet Password Policies = Original Author: Beth Mercer - 20081104 == Definitions == Thoughout this document are references to ldap_* commands. Those are simply scripted invocations of the associated ldap* utilities that make it possible to search the directory, and to add, modify and delete directory data using the Directory Manager credentials. The ldap_* scripts can be found on the "e" boxes under ~iplanet/local/ldap/scripts. Although "only regents can set policy", iPlanet refers to a set of password/account configuration settings as a "Password Policy". That is the intent of the term "policy" throughout this document. == Default Password Policy == iPlanet supports one default password policy at the /config level. The default password policy dictates the behavior of any directory record not explicitly associated with another, non-default password policy. The settings for the default policy in all Enterprise Directory instances (test, prep and production) are the same. They can be seen/modified via the iPlanet console or they can be seen and updated by using command line utilities. === Query the LDAP Configuration for an Instance === The following example queries PROD: {{{ iplanet@egegik> ldap_queryConfigProd "(cn=Password Policy)" dn: cn=Password Policy,cn=config objectClass: top objectClass: passwordPolicy cn: Password Policy passwordInHistory: 5 passwordStorageScheme: SSHA passwordUnlock: on passwordMustChange: on passwordNonRootMayResetUserpwd: off passwordWarning: 604800 passwordExpireWithoutWarning: on passwordLockout: on passwordMinLength: 8 passwordMaxFailure: 5 passwordMaxAge: 34560000 passwordResetFailureCount: 600 passwordisglobalpolicy: on passwordChange: on passwordExp: on passwordLockoutDuration: 1800 passwordCheckSyntax: on passwordMinAge: 0 passwordRootdnMayBypassModsChecks: on }}} === Modify LDAP Password Policy for an Instance === {{{ iplanet@egegik> ldap_modifyProd "(cn=Password Policy)" dn: cn=Password Policy,cn=config changetype: modify replace: passwordMaxAge passwordMaxAge: }}} == Creating Additional Password Policies == iPlanet supports creation of additional password policies but those policies must be manually associated with a directory account much like any other piece of directory data. Additional password policies can be created using ldapadd and associated with individual directory records using iPlanet ''ldapmodify'' command. The following three examples show how one might create a new policy that is associated with a directory. === First Delete the Instance Default Password === {{{ iplanet@egegik> ldap_deleteTest inst: test port: 13338 ldapdelete: started Tue Nov 4 07:19:30 2008 ldap_init( egegik, 13338 ) ldaptool_getcertpath -- /e01/iplanet/servers/alias/slapd-egegiktest-cert8.db ldaptool_getkeypath -- /e01/iplanet/servers/alias/slapd-egegiktest-cert8.db ldaptool_getdonglefilename -- (null) cn=Password Policy,ou=resource,dc=alaska,dc=edu deleting entry cn=Password Policy,ou=resource,dc=alaska,dc=edu entry removed }}} === Create a New Password Policy for the Instance === {{{ iplanet@egegik> cat create_resource_password_policyTest.20070220 dn: cn=Password Policy,ou=resource,dc=alaska,dc=edu objectClass: top objectClass: passwordPolicy objectClass: LDAPsubentry cn: Password Policy passwordStorageScheme: SSHA passwordChange: on passwordMinAge: 0 passwordUnlock: on passwordResetFailureCount: 600 passwordMustChange: off passwordInHistory: 10 passwordExp: off passwordMaxAge: 0 passwordWarning: 604800 passwordCheckSyntax: on passwordRootdnMayBypassModsChecks: on passwordMinLength: 8 passwordLockout: off passwordMaxFailure: 5 passwordLockoutDuration: 1800 }}} === Add the Password Policy to the Instance === {{{ iplanet@egegik> ldap_addTest -f create_resource_password_policyTest.20070220 inst: test port: 13338 ldapmodify: started Mon Nov 3 15:58:15 2008 ldap_init( egegik, 13338 ) ldaptool_getcertpath -- /e01/iplanet/servers/alias/slapd-egegiktest-cert8.db ldaptool_getkeypath -- /e01/iplanet/servers/alias/slapd-egegiktest-cert8.db ldaptool_getdonglefilename -- (null) add objectClass: top passwordPolicy LDAPsubentry add cn: Password Policy add passwordStorageScheme: SSHA add passwordChange: on add passwordMinAge: 0 add passwordUnlock: on add passwordResetFailureCount: 600 add passwordMustChange: off add passwordInHistory: 10 add passwordExp: off add passwordMaxAge: 0 add passwordWarning: 604800 add passwordCheckSyntax: on add passwordRootdnMayBypassModsChecks: on add passwordMinLength: 8 add passwordLockout: off add passwordMaxFailure: 5 add passwordLockoutDuration: 1800 adding new entry cn=Password Policy,ou=resource,dc=alaska,dc=edu modify complete }}} === Modify a Resource Using a Script to Invoke iPlanet '''ldapmodify''' === Once a password policy exists, modifying it is accomplished in the usual way. In the example below, the script, ldap_modifyTest does the invocation for the usual iPlanet ''ldapmodify'' command that can be run from the command line. {{{ iplanet@egegik> ldap_modifyTest dn: uid=fake03,dc=resource,dc=alaska,dc=edu changetype: modify replace: passwordPolicySubentry passwordPolicySubentry: cn=Password Policy,ou=resource,dc=alaska,dc=edu }}} Changes to max age impact only future password changes. If a password expiration has already been established for a directory record, that expiration remains in effect until the next time the password is changed. ''Note:'' Work on an additional password policy that might someday be applied to ou=resource records can be found on egegik under ~iplanet/local/ldap/schema/POLICY.