password policy control

The password policy request control is a type of LDAP control that can be used to request information about the current password policy state for a user entry. It is defined in draft-sisbehera-ldap-password-policy. Both the request and response controls have an OID of 1.3.6.1.4.1.42.2.27.8.5.1. The request control does not have a value. The response control value is encoded as follows:

PasswordPolicyResponseValue ::= SEQUENCE {
     warning [0] CHOICE {
          timeBeforeExpiration [0] INTEGER (0 .. maxInt),
          graceAuthNsRemaining [1] INTEGER (0 .. maxInt) } OPTIONAL,
     error   [1] ENUMERATED {
          passwordExpired             (0),
          accountLocked               (1),
          changeAfterReset            (2),
          passwordModNotAllowed       (3),
          mustSupplyOldPassword       (4),
          insufficientPasswordQuality (5),
          passwordTooShort            (6),
          passwordTooYoung            (7),
          passwordInHistory           (8) } OPTIONAL }

For an example of using this control in a search request, see To Search Using the Password Policy Control in Sun OpenDS Standard Edition 2.0 Administration Guide.