Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: <Carlo.Accorsi@ibs-ag.com>
To: <users@directory.apache.org>
Date: Tue, 19 Mar 2013 23:17:28 +0100
Subject: Want to force password end time
Thread-Topic: Want to force password end time
Thread-Index: Ac4k71mSv861CNLGRPGMvFwwXNHFaA==
Message-ID: <2BE7E81B77921F43A6A273C2DF2FA6A43CDC5D9FF1@IBSMBX.ibs-ag.com>
Accept-Language: en-US, de-DE
Content-Language: en-US
acceptlanguage: en-US, de-DE
Content-Type: multipart/alternative;
	boundary="_000_2BE7E81B77921F43A6A273C2DF2FA6A43CDC5D9FF1IBSMBXibsagco_"
MIME-Version: 1.0

--_000_2BE7E81B77921F43A6A273C2DF2FA6A43CDC5D9FF1IBSMBXibsagco_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi All,
We have a password policy enabled for users with ads-pwdmustchange=3DTRUE.
When an admin changes a user's password , the pwdReset=3Dtrue attribute is =
set as on the user entry as expected.
We get the correct response control and direct a user to a change password =
page.
This all works great however, this temporary password remains valid for per=
iod defined in the policy.

Ideally, after receiving the response control for password must change, I'd=
 like to expire the temporary password after 10 minutes.
This way if they defeat our change password routine by canceling it, the pa=
ssword wouldn't remain valid for long.

Since we never know when the first time they'll login after pwdReset=3Dtrue=
 is set, this is something I want to do individually on the user entry duri=
ng the login process.
I've tried setting pwdEndTime on the user entry. This looks like it might b=
e what I want but I get a no user modification exception.

Can you think of any way to do this?
Thanks!


java.lang.Exception: [LDAP: error code 50 - INSUFFICIENT_ACCESS_RIGHTS: fai=
led for MessageType : MODIFY_REQUEST
Message ID : 67
    Modify Request
        Object : 'uid=3D1337172529807,ou=3Dusers,ou=3Dint,o=3Dcpro'
            Modification[0]
                Operation :  add
                Modification
pwdEndTime: 20130319220004.006Z
org.apache.directory.api.ldap.model.message.ModifyRequestImpl@8ae625e6: ERR=
_52 Cannot modify the attribute : ATTRIBUTE_TYPE ( 1.3.6.1.4.1.42.2.27.8.1.=
28
NAME 'pwdEndTime'
DESC The time the password becomes disabled
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
SINGLE-VALUE
NO-USER-MODIFICATION
USAGE directoryOperation
)
]


--_000_2BE7E81B77921F43A6A273C2DF2FA6A43CDC5D9FF1IBSMBXibsagco_--