Password Policies in Oracle Internet Directory, 3 of 4

Managing Password Policies

This section contains these topics:

Table 15-1 lists the administrative tasks related to password policies, the tools you use to perform each one, and points you to the corresponding information.

Table 15-1 Tasks and Tools for Managing Password Polices

Task	Tools	Instructions
Enabling and disabling accounts	Oracle Internet Directory Self-Service Console ldapmodify	"Enabling and Disabling Accounts by Using the Oracle Internet Directory Self-Service Console" "Example: Enabling and Disabling Accounts by Using Command-Line Tools"
Forcing a password change	ldapmodify	"Example: Forcing a Password Change by Using Command-Line Tools"
Modifying password policies for an identity management realm	Oracle Directory Manager ldapmodify	"Modifying Password Policies of an Identity Management Realm by Using Oracle Directory Manager" "Example: Modifying Password Policies of an Identity Management Realm by Using Command-Line Tools"
Setting password policies	ldapmodify	"Example: Setting Password Policies by Using Command-Line Tools"
Unlocking accounts	Oracle Internet Directory Self-Service Console ldapmodify	"Unlocking Accounts by Using the Oracle Internet Directory Self-Service Console" "Example: Unlocking Accounts by Using Command-Line Tools"
Viewing password policies for an identity management realm	Oracle Directory Manager ldapsearch	"Viewing Password Policies of an Identity Management Realm by Using Oracle Directory Manager" "Example: Viewing Password Policies of an Identity Management Realm by Using Command-Line Tools"

Managing Password Policies by Using Oracle Directory Manager

When you create the base entry for an identity management realm--whether during an Oracle Internet Directory installation or later--you also create a password policy entry for that realm. Later, you can use Oracle Directory Manager to view, refresh, and modify those policies.

This section contains these topics:

Viewing Password Policies of an Identity Management Realm by Using Oracle Directory Manager

To view the password policies for a particular identity management realm, in the navigator pane, expand in succession Oracle Internet Directory Servers, directory server instance, Password Policy Management. The navigator pane displays the password policy entries for the identity management realm. The right pane displays a table with two columns:

The Path to Password Policy Entry column lists the full DN of each password policy entry
The Password Policy Entry column lists the corresponding RDNs of those policies

To get the latest updates to realm-specific password policies, choose Refresh.

To get the password polices of a particular realm, in the navigator pane, choose the realm-specific password policy you want to view. The policies appear in the right pane.

See Also:
"Password Policy Fields in Oracle Directory Manager" for a description of each password policy displayed in Oracle Directory Manager

Modifying Password Policies of an Identity Management Realm by Using Oracle Directory Manager

To modify the password policies for a particular identity management realm:

In the navigator pane, expand in succession Oracle Internet Directory Servers, directory server instance, Password Policy Management.
In the navigator pane, choose the realm-specific password policy you want to modify. The corresponding tab pages appear in the right pane.
In the General tab page, modify the editable attribute fields as needed. These fields are described in Table C-8 .
Select the Account Lockout tab page and, to modify the fields, select Global Lockout. Modify the editable attribute fields as needed. These fields are described in Table C-9 .
Select the IP Lockout tab page and, to modify the fields, select IP Lockout. Modify the editable attribute fields as needed. These fields are described in Table C-10 .
Select the Password Syntax tab page and, to modify the fields, select Check Password Syntax. Modify the editable attribute fields as needed. These fields are described in Table C-11 .
When you are finished, choose Apply.

Managing Password Policies by Using Command-Line Tools

This section contains these topics:

Example: Setting Password Policies by Using Command-Line Tools

The following example disables the pwdLockout attribute, changing it from its default setting of 1.

The file my_file.ldif contains:

dn: cn=pwdpolicyentry,cn=common,cn=products,cn=OracleContext,o=my_company,dc=com
changetype:modify
replace: pwdlockout
pwdlockout: 0

The following command loads this file into the directory:

ldapmodify -p 389 -h myhost -f my_file.ldif

Examples: Managing the Password Policies of an Identity Management Realm by Using Command-Line Tools

Look at the following examples to learn how to view and modify the password policies of a realm by using command-line tools.

Example: Viewing Password Policies of an Identity Management Realm by Using Command-Line Tools

The following example retrieves a specific password policy entry.

ldapsearch -p 389 -h my_host -b 
"cn=pwdpolicyentry,cn=common,cn=products,cn=OracleContext,o=my_company,dc=com" 
-s base "objectclass=*"

The following example retrieves all password policy entries:

ldapsearch -p 389 -h my_host -b "" -s sub "objectclass=pwdpolicy"

Example: Modifying Password Policies of an Identity Management Realm by Using Command-Line Tools

The following example modifies a password policy entry.

ldapmodify -p 389 -h my_host -v <<EOF
dn: cn=pwdpolicyentry,cn=common,cn=products,cn=OracleContext,o=my_company,dc=com
changetype: modify
replace: pwdMaxAge
pwdMaxAge: 100000

Example: Enabling and Disabling Accounts by Using Command-Line Tools

You can temporarily disable a user's account, then enable it once again, by using command-line tools.

To permanently disable the account by setting the orclisenabled attribute to DISABLED. Setting this attribute to any other value enables the account.

To enable the account after you have disabled it, delete this attribute from the entry.

To enable the account for a specific period, set the orclActiveStartDate and orclActiveEndDate attributes in the user entry to the proper value in UTC (Coordinated Universal Time) format. For example:

cn=John Doe,cn=users,o=my_company,dc=com
orclactivestartdate:20030101000000z
orclactiveenddate: 20031231000000z

In this example, John Doe can log in only between January 1, 2003 and December 31, 2003. He cannot login prior to January 1, 2003 or after December 31, 2003. If you want to disable his account for a period of time between these dates, then set the orclisenabled attribute to FALSE.

Example: Unlocking Accounts by Using Command-Line Tools

If you are a member of the Security Administrators Group, then, if an account becomes locked, you can unlock it without resetting the user password. This saves you from having to explicitly tell the user the new password. The user can simply log in by using the old password.

To unlock an account, set the orclpwdaccountunlock attribute to 1.

The following example unlocks the account for user John Doe.

ldapmodify -p port_number -h host_name -D cn=orcladmin -w welcome -v <<EOF
dn: cn=John Doe,cn=users,o=my_company,dc=com
changetype: modify
add: orclpwdaccountunlock
orclpwdaccountunlock: 1

Example: Forcing a Password Change by Using Command-Line Tools

You can force users to change their passwords when they log in for the first time. To do this, set the pwdMustChange attribute in the pwdpolicy entry to TRUE, and then reset the password. If you do this, you must explicitly tell the user the new password so that the user can login to change that password.

See Also:
"Resetting Your Own Password by Using the Oracle Internet Directory Self-Service Console" for instructions on resetting passwords

Managing Password Policies by Using the Self-Service Console

This section contains these topics:

Managing Accounts by Using the Oracle Internet Directory Self-Service Console

You can use the Oracle Internet Directory Self-Service Console to enable, disable, and unlock user accounts.

Enabling and Disabling Accounts by Using the Oracle Internet Directory Self-Service Console

You can temporarily disable a user's account, then enable it once again, by using the Oracle Internet Directory Self-Service Console.

See Also:
"Enabling User Accounts" and "Disabling User Accounts" for instructions on enabling and disabling accounts by using the Oracle Internet Directory Self-Service Console

Unlocking Accounts by Using the Oracle Internet Directory Self-Service Console

See Also:
"Unlocking User Accounts" for instructions on using the Oracle Internet Directory Self-Service Console to unlock accounts

Resetting Your Own Password by Using the Oracle Internet Directory Self-Service Console

If you forget your password or become locked out of your account, then you can reset your password. This involves identifying yourself to the server by providing values for a set of password validation attributes. This takes the form of answering a password hint question to which you had earlier specified an answer.

See Also:
"Resetting Your Password If You Forget It" for instructions on using the Oracle Internet Directory Self-Service Console to reset your password