Resetting Expired Passwords

When password policy enforces password expiration, some users will not change their passwords in time. This section shows how you can change passwords that have expired.

This section includes procedures for resetting a password with the password modify extended operation and for allowing grace authentications when passwords expire.

The mechanisms described in this section are intended for use by administrators, or by applications that handle the actual user interaction with the directory. You typically rely on an application to ensure that the end user is in fact using the mechanisms in the way you intended.

To Reset a Password With the Password Modify Extended Operation

User accounts are locked when passwords expire. When you reset the password, you unlock the account. The password can be reset by another user such as an administrator. After password reset, Directory Server unlocks the user account. Directory Server provides support for RFC 3062, LDAP Password Modify Extended Operation. The extended operation enables you to allow a directory administrator or a directory application to unlock accounts through password reset.

Be cautious when allowing use of the password modify extended operation, as shown in this procedure. Limit access to administrators and applications that you trust. Do not allow passwords to travel over the network in clear text.

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

1. Give users access to a password administrator or to a password administration application.
2. Allow the password administrator access to use the password modify extended operation.

   The following commands set an ACI to allow members of a Password Managers role to use the password modify extended operation when connected over SSL:

   $ cat exop.ldif
   dn: oid=1.3.6.1.4.1.4203.1.11.1,cn=features,cn=config
   objectClass: top
   objectClass: directoryServerFeature
   oid: 1.3.6.1.4.1.4203.1.11.1
   cn: Password Modify Extended Operation
   aci: (targetattr != "aci")
   (version 3.0; acl "Password Modify Extended Operation"; 
   allow( read, search, compare, proxy ) 
   (roledn = "ldap:///cn=Password Managers,dc=example,dc=com" and authmethod = "SSL");)
   
   $ ldapmodify -a -D cn=admin,cn=Administrators,cn=config -w - -f exop.ldif
   Enter bind password: 
   adding new entry oid=1.3.6.1.4.1.4203.1.11.1,cn=features,cn=config
   
   $

   The entry under cn=features,cn=config allows you to manage access to operations that use the password modify extended operation.

3. Have the password administrator reset the user password.

   This step unlocks the user account, and can be completed with the ldappasswd(1) command.

4. (Optional) If the user must change the password, have the password administrator notify the user.

   Users must change their passwords after reset if the password policy that governs their entries includes pwdMustChange: TRUE.

To Allow Grace Authentications When Passwords Expire

This procedure describes how to give users grace authentications, allowing users to change passwords that have expired.

The grace authentications are intended to be managed by an application that handles password policy request and response controls. The procedure shows a simple example of how to use the control in an application.

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

1. Make sure that users have access to an application that uses password policy request and response controls.

   The application should ensure that users handle grace authentications properly.

2. Allow the application to use the password policy controls.

   The following commands set an ACI to allow members of a Password Managers role to use the password policy controls:

   $ cat ctrl.ldif
   dn: oid=1.3.6.1.4.1.42.2.27.8.5.1,cn=features,cn=config
   objectClass: top
   objectClass: directoryServerFeature
   oid: 1.3.6.1.4.1.42.2.27.8.5.1
   cn: Password Policy Controls
   aci: (targetattr != "aci")
   (version 3.0; acl "Password Policy Controls"; 
   allow( read, search, compare, proxy ) 
   roledn = "ldap:///cn=Password Managers,dc=example,dc=com";)
   
   $ ldapmodify -a -D cn=admin,cn=Administrators,cn=config -w - -f ctrl.ldif
   Enter bind password: 
   adding new entry oid=1.3.6.1.4.1.42.2.27.8.5.1,cn=features,cn=config
   
   $

   The entry under cn=features,cn=config has the sole purpose of allowing you to manage access to operations that use the password policy request and response controls.

3. Set pwdGraceAuthNLimit in the password policy to the number of authentications to allow after the password has expired.
4. Make sure that the application guides the end user to change the expired password promptly before grace authentications are exhausted.

   ---

   Caution - The DS5–compatibility-mode password policy is deprecated. You must switch to DS6–mode password policy in this version.

   ---