Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Date: Fri, 6 Dec 2013 10:33:35 +0000 (UTC)
From: "Konrad Windszus (JIRA)" <jira@apache.org>
To: dev@directory.apache.org
Message-ID: <JIRA.12683088.1386323460125.84276.1386326015761@arcas>
In-Reply-To: <JIRA.12683088.1386323460125@arcas>
References: <JIRA.12683088.1386323460125@arcas>
Subject: [jira] [Commented] (DIRSERVER-1927) pwdmaxfailure seems not be be
 respected correctly
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/DIRSERVER-1927?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13841159#comment-13841159 ] 

Konrad Windszus commented on DIRSERVER-1927:
--------------------------------------------

Compare with 5.2.13 from RFC draft for password policies (http://tools.ietf.org/html/draft-behera-ldap-password-policy-10)

{quote}
5.2.13. pwdMaxFailure

   This attribute specifies the number of consecutive failed bind
   attempts after which the password may not be used to authenticate.
   If this attribute is not present, or if the value is 0, this policy
   is not checked, and the value of pwdLockout will be ignored.

         ( 1.3.6.1.4.1.42.2.27.8.1.11
         NAME 'pwdMaxFailure'
         EQUALITY integerMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
         SINGLE-VALUE )
{quote}

> pwdmaxfailure seems not be be respected correctly
> -------------------------------------------------
>
>                 Key: DIRSERVER-1927
>                 URL: https://issues.apache.org/jira/browse/DIRSERVER-1927
>             Project: Directory ApacheDS
>          Issue Type: Bug
>         Environment: Ubuntu 12.04 64bit Server, apacheds-2.0.0-M12-default
>            Reporter: Stephan Becker
>
> Goal:
> is to lock an account but not allow automatic account locking by failed attempts.
> Supposed working method:
> using -1 or 0 as a value or deleting the ads-pwdmaxfailure attribute to not allow automatic account locking
> Result:
> using the above methods locks the account anyways
> Workaround:
> using the max value of 99999999 works BUT using this value might cause an issue f.e. with a technical user experiencing a connection loss or some other issue.


--
This message was sent by Atlassian JIRA
(v6.1#6144)