Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <49FCB3C3.3060807@labeo.de>
Date: Sat, 02 May 2009 22:57:39 +0200
From: Stefan Zoerner <stefan@labeo.de>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: users@directory.apache.org
Subject: Re: Force Change Password
References: <37cc2c090905020944k3150e9caibec8178543bc06bf@mail.gmail.com>
In-Reply-To: <37cc2c090905020944k3150e9caibec8178543bc06bf@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi Carlo,

Carlo Camerino wrote:
> I just want to know if Apache Directory server can do the following.
> 
> 1.) Can it force the users to change password? (Expire password after a
> specific time period)
> 2.) Can I make a list of commonly used passwords that users shouldn't use?

The functionality w.r.t. password polices is not that impressive yet. 
There is a Password Policy Interceptor, which has to be enabled. It 
deals with minimal password complexity etc. defaults (if enabled) to this:

* The password is at least six characters long.
* The password contains a mix of characters.
* The password does not contain three letter (or more) tokens from the 
user's account name.

It would be quite easy to extend it to forbid certain password values. 
But you have to extend the corresponding class and modify the 
configuration in server.xml to accomplish that.

This helps at least for question 2 (hopefully).

Greetings from Hamburg,
     Stefan