Managing the Default Password Policy

The default password policy applies to all users in the directory instance who do not have a specialized policy defined. However, the default password policy does not apply to the Directory Manager. See Which Password Policy Applies for details on policy scope.

The default password policy is the one policy that you can configure using the dsconf command. You can also view default password policy by reading cn=Password Policy,cn=config.

This section shows the policy attributes for each policy area and the related dsconf server properties. It also explains how to view and change default password policy settings.

Correlation Between Password Policy Attributes and `dsconf` Server Properties

The following table shows the password policy attributes and related dsconf server properties for each password policy area.

Policy Area	Policy Attribute	`dsconf` Server Property
Account Lockout	`pwdFailureCountInterval`	`pwd-failure-count-interval`
	`pwdLockout`	`pwd-lockout-enabled`
	`pwdLockoutDuration`	`pwd-lockout-duration`
	`pwdMaxFailure`	`pwd-max-failure-count`
Password Changes	`passwordRootdnMayBypassModsChecks`	`pwd-root-dn-bypass-enabled`
	`pwdAllowUserChange`	`pwd-user-change-enabled`
	`pwdInHistory`	`pwd-max-history-count`
	`pwdMinAge`	`pwd-min-age`
	`pwdMustChange`	`pwd-must-change-enabled`
	`pwdSafeModify`	`pwd-safe-modify-enabled`
Password Content	`pwdCheckQuality`	`pwd-check-enabled`, `pwd-accept-hashed-password-enabled`, `pwd-strong-check-dictionary-path`, `pwd-strong-check-enabled`, `pwd-strong-check-require-charset`
	`pwdMinLength`	`pwd-min-length`
	`passwordStorageScheme`	`pwd-storage-scheme`
Password Expiration	`pwdExpireWarning`	`pwd-expire-warning-delay`
	`pwdGraceAuthNLimit`	`pwd-grace-login-limit`
	`pwdMaxAge`	`pwd-max-age`
Tracking Last Authentication Time	`pwdKeepLastAuthTime`	`pwd-keep-last-auth-time-enabled`

Note - The properties that correlate to pwdCheckQuality configure the Password Check plug-in. Therefore, the five properties apply to the entire server instance. The five properties thus also apply to other password policies where pwdCheckQuality: 2.

To View Default Password Policy Settings

You can view default password policy settings with the dsconf command.

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

Read the default password policy configuration.

$ dsconf get-server-prop -h host -p port -v -i \
-w password-file | grep ^pwd-

The password-file contains the password of directory manager.

pwd-accept-hashed-pwd-enabled      :  N/A
pwd-check-enabled                  :  off
pwd-compat-mode                    :  DS5-compatible-mode
pwd-expire-no-warning-enabled      :  on
pwd-expire-warning-delay           :  1d
pwd-failure-count-interval         :  10m
pwd-grace-login-limit              :  disabled
pwd-keep-last-auth-time-enabled    :  off
pwd-lockout-duration               :  1h
pwd-lockout-enabled                :  off
pwd-lockout-repl-priority-enabled  :  on
pwd-max-age                        :  disabled
pwd-max-failure-count              :  3
pwd-max-history-count              :  disabled
pwd-min-age                        :  disabled
pwd-min-length                     :  6
pwd-mod-gen-length                 :  6
pwd-must-change-enabled            :  off
pwd-root-dn-bypass-enabled         :  off
pwd-safe-modify-enabled            :  off
pwd-storage-scheme                 :  SSHA
pwd-strong-check-dictionary-path   :  instance-path/plugins/words-english-big.txt
pwd-strong-check-enabled           :  off
pwd-strong-check-require-charset   :  lower
pwd-strong-check-require-charset   :  upper
pwd-strong-check-require-charset   :  digit
pwd-strong-check-require-charset   :  special
pwd-supported-storage-scheme       : CRYPT
pwd-supported-storage-scheme       : SHA256
pwd-supported-storage-scheme       : SHA512
pwd-supported-storage-scheme       : SHA
pwd-supported-storage-scheme       : SSHA
pwd-supported-storage-scheme       : SSHA256
pwd-supported-storage-scheme       : SSHA512
pwd-supported-storage-scheme       : CLEAR 
pwd-user-change-enabled            :  on

To Change Default Password Policy Settings

You can change the default password policy by setting server properties with the dsconf command.

Note - Before completing this procedure, read and complete the Worksheet for Defining Password Policy.

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

Translate the settings from your worksheet into dsconf command property settings.
Use the dsconf set-server-prop command to change default password policy properties appropriately.
For example, the following command allows the Directory Manager to violate the default policy when modifying passwords:
```
$ dsconf set-server-prop -h host -p port pwd-root-dn-bypass-enabled:on
```
The following command enables the policy that requires changing the password after a reset:
```
# dsconf set-server-prop  -p 20390 pwd-must-change-enabled:on
```

Preventing Binds With No Password

Directory Server prevents authentication with a null password. All non-anonymous binds must therefore specify a password to bind to the directory. Otherwise, Directory Server returns an authentication error, LDAP_INAPPROPRIATE_AUTH.

You can disable this feature by setting the server property require-bind-pwd-enabled to off using the dsconf set-server-prop command.

The default value of the Require Bind on Authentication feature is on. Check this by using the following command:

# dsconf get-server-prop -p 20390 -w /tmp/.pwd-file require-bind-pwd-enabled
require-bind-pwd-enabled  :  on

Authenticating with a null password results in the following error message:

# ldapsearch -D cn=altrootdn -w '' -p 20390 -b cn=config 'objectclass=*' dn
ldap_simple_bind: Inappropriate authentication
ldap_simple_bind: additional info: binds with a dn require a password

Note that this feature does not block anonymous binds:

# ldapsearch -p 20390 -b cn=config 'objectclass=*' dn
version: 1
dn: cn=SNMP,cn=config

Disable this feature by setting it to off:

# dsconf set-server-prop -p 20390 -w /tmp/.pwd-file require-bind-pwd-enabled:off
# dsconf get-server-prop -p 20390 -w /tmp/.pwd-file require-bind-pwd-enabled
require-bind-pwd-enabled  :  off

This time authenticating with a null password succeeds:

# ldapsearch -D cn=altrootdn -w '' -p 20390 -b cn=config 'objectclass=*' dn
version: 1
dn: cn=SNMP,cn=config

Skip Navigation Links
Exit Print View
	Oracle Directory Server Enterprise Edition Administration Guide 11g Release 1 (11.1.1.5.0)