The ppolicy overlay is an implementation of the most recent IETF Password Policy proposal for LDAP. When instantiated, it intercepts, decodes and applies specific password policy controls to overall use of a backend database, changes to user password fields, etc.
ppolicy オーバレイは、最新の IETF の LDAP パスワードポリシー提案に基づく実装です。
The overlay provides a variety of password control mechanisms. They include password aging--both minimum and maximum ages, password reuse and duplication control, account time-outs, mandatory password resets, acceptable password content, and even grace logins. Different groups of users may be associated with different password policies, and there is no limit to the number of password policies that may be created.
このオーバレイはさまざまなパスワード制御機構を提供します。 パスワードの有効期間、アカウントのタイムアウト、 パスワードリセット パスワードの文法、
この実装ではさらに pwdPolicyChecker オブジェクトクラスを用意しています。 これはパスワード品質のチェックに使います(後述)。
pwdAttribute This attribute contains the name of the attribute to which the password policy is applied. For example, the password policy may be applied to the userPassword attribute. Note: in this implementation, the only value accepted for pwdAttribute is userPassword .
pwdMinAge This attribute contains the number of seconds that must elapse between modifications allowed to the password. If this attribute is not present, zero seconds is assumed (i.e. the password may be modified whenever and however often is desired).
pwdMaxAge This attribute contains the number of seconds after which a modified password will expire. If this attribute is not present, or if its value is zero (0), then passwords will not expire.
pwdInHistory This attribute is used to specify the maximum number of used passwords that will be stored in the pwdHistory attribute. If the pwdInHistory attribute is not present, or if its value is zero (0), used passwords will not be stored in pwdHistory and thus any previously-used password may be reused.
pwdCheckQuality This attribute indicates if and how password syntax will be checked while a password is being modified or added. If this attribute is not present, or its value is zero (0), no syntax checking will be done. If its value is one (1), the server will check the syntax, and if the server is unable to check the syntax, whether due to a client-side hashed password or some other reason, it will be accepted. If its value is two (2), the server will check the syntax, and if the server is unable to check the syntax it will return an error refusing the password.
pwdMinLength When syntax checking is enabled (see also the pwdCheckSyntax attribute), this attribute contains the minimum number of characters that will be accepted in a password. If this attribute is not present, minimum password length is not enforced. If the server is unable to check the length of the password, whether due to a client-side hashed password or some other reason, the server will, depending on the value of pwdCheckSyntax, either accept the password without checking it (if pwdCheckSyntax is zero (0) or one (1)) or refuse it (if pwdCheckSyntax is two (2)).
pwdExpireWarning This attribute contains the maximum number of seconds before a password is due to expire that expiration warning messages will be returned to a user who is authenticating to the directory. If this attribute is not present, or if the value is zero (0), no warnings will be sent.
pwdGraceAuthnLimit This attribute contains the number of times that an expired password may be used to authenticate a user to the directory. If this attribute is not present or if its value is zero (0), users with expired passwords will not be allowed to authenticate to the directory.
pwdLockout This attribute specifies the action that should be taken by the directory when a user has made a number of failed attempts to authenticate to the directory. If pwdLockout is set (its value is "TRUE"), the user will not be allowed to attempt to authenticate to the directory after there have been a specified number of consecutive failed bind attempts. The maximum number of consecutive failed bind attempts allowed is specified by the pwdMaxFailure attribute. If pwdLockout is not present, or if its value is "FALSE", the password may be used to authenticate no matter how many consecutive failed bind attempts have been made.
pwdLockoutDuration This attribute contains the number of seconds during which the password cannot be used to authenticate the user to the directory due to too many consecutive failed bind attempts. (See also pwdLockout and pwdMaxFailure.) If pwdLockoutDuration is not present, or if its value is zero (0), the password cannot be used to authenticate the user to the directory again until it is reset by an administrator.
pwdMaxFailure This attribute contains the number of consecutive failed bind attempts after which the password may not be used to authenticate a user to the directory. If pwdMaxFailure is not present, or its value is zero (0), then a user will be allowed to continue to attempt to authenticate to the directory, no matter how many consecutive failed bind attempts have occurred with that user's DN. (See also pwdLockout and pwdLockoutDuration.)
pwdFailureCountInterval This attribute contains the number of seconds after which old consecutive failed bind attempts are purged from the failure counter, even though no successful authentication has occurred. If pwdFailureCountInterval is not present, or its value is zero (0), the failure counter will only be reset by a successful authentication.
pwdMustChange This attribute specifies whether users must change their passwords when they first bind to the directory after a password is set or reset by the administrator, or not. If pwdMustChange has a value of "TRUE", users must change their passwords when they first bind to the directory after a password is set or reset by the administrator. If pwdMustChange is not present, or its value is "FALSE", users are not required to change their password upon binding after the administrator sets or resets the password.
pwdAllowUserChange This attribute specifies whether users are allowed to change their own passwords or not. If pwdAllowUserChange is set to "TRUE", or if the attribute is not present, users will be allowed to change their own passwords. If its value is "FALSE", users will not be allowed to change their own passwords.
pwdSafeModify This attribute denotes whether the user's existing password must be sent along with their new password when changing a password. If pwdSafeModify is set to "TRUE", the existing password must be sent along with the new password. If the attribute is not present, or its value is "FALSE", the existing password need not be sent along with the new password.
pwdCheckModule This attribute names a user-defined loadable module that must instantiate the check_password() function. This function will be called to further check a new password if pwdCheckQuality is set to one (1) or two (2), after all of the built-in password compliance checks have been passed. This function will be called according to this function prototype:
userPassword The attribute is not strictly part of the ppolicy module. It is, however, the attribute that is tracked and controlled by the module. Please refer to the standard OpenLDAP schema for its definition.
pwdPolicySubentry This attribute refers directly to the pwdPolicy subentry that is to be used for this particular directory user. If pwdPolicySubentry exists, it must contain the DN of a valid pwdPolicy object. If it does not exist, the ppolicy module will enforce the default password policy rules on the user associated with this authenticating DN. If there is no default, or the referenced subentry does not exist, then no policy rules will be enforced.
pwdChangedTime This attribute denotes the last time that the entry's password was changed. This value is used by the password expiration policy to determine whether the password is too old to be allowed to be used for user authentication. If pwdChangedTime does not exist, the user's password will not expire.
pwdAccountLockedTime This attribute contains the time that the user's account was locked. If the account has been locked, the password may no longer be used to authenticate the user to the directory. If pwdAccountLockedTime is set to zero (0), the user's account has been permanently locked and may only be unlocked by an administrator.
pwdFailureTime This attribute contains the timestamps of each of the consecutive authentication failures made upon attempted authentication to this DN (i.e. account). If too many timestamps accumulate here (refer to the pwdMaxFailure password policy attribute for details), and the pwdLockout password policy attribute is set to "TRUE", the account may be locked. (Please also refer to the pwdLockout password policy attribute.) Excess timestamps beyond those allowed by pwdMaxFailure may also be purged. If a successful authentication is made to this DN (i.e. to this user account), then pwdFailureTime will be cleansed of entries.
pwdHistory This attribute contains the history of previously used passwords for this DN (i.e. for this user account). The values of this attribute are stored in string format as follows:
pwdHistory=
time=
syntaxOID = numericoid
length = numericstring
data =
This format allows the server to store and transmit a history of passwords that have been used. In order for equality matching on the values in this attribute to function properly, the time field is in GMT format.
pwdGraceUseTime This attribute contains the list of timestamps of logins made after the user password in the DN has expired. These post-expiration logins are known as gracelogins . If too many grace logins have been used (please refer to the pwdGraceLoginLimit password policy attribute), then the DN will no longer be allowed to be used to authenticate the user to the directory until the administrator changes the DN's userPassword attribute.
pwdReset This attribute indicates whether the user's password has been reset by the administrator and thus must be changed upon first use of this DN for authentication to the directory. If pwdReset is set to "TRUE", then the password was reset and the user must change it upon first authentication. If the attribute does not exist, or is set to "FALSE", the user need not change their password due to administrative reset.
database bdb suffix dc=example,dc=com ... overlay ppolicy ppolicy_default "cn=Standard,ou=Policies,dc=example,dc=com"
"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)
IETF LDAP password policy proposal by P. Behera, L. Poitou and J. Sermersheim: documented in IETF document "draft-behera-ldap-password-policy-09.txt".
LDAPパスワードポリシー仕様はまだ認可された標準ではなく、作業中のものです。 このコードは、パスワードポリシーの仕様が確定するまで流動的であり続けます。