<
para>You manage subentry password policies by adding the subentries
alongside the user data. Thus OpenDJ can replicate subentry password
policies across servers.</
para>
<
primary>Password policy</
primary>
<
secondary>Behera Internet-Draft</
secondary>
<
para>Subentry password policies support the Internet-Draft <
link >Password Policy for LDAP Directories</
link> (version 09). A subentry
password policy effectively overrides settings in the default password
policy defined in the OpenDJ configuration. Settings not supported or not
included in the subentry password policy are thus inherited from the default
<
para>As a result, the following Internet-Draft password policy attributes
override the default password policy when you set them in the
<
listitem><
para><
literal>pwdAllowUserChange</
literal>, corresponding to the
OpenDJ password policy property
<
literal>allow-user-password-changes</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdMustChange</
literal>, corresponding to the
OpenDJ password policy property
<
literal>force-change-on-reset</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdGraceAuthNLimit</
literal>, corresponding to the
OpenDJ password policy property
<
literal>grace-login-count</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdLockoutDuration</
literal>, corresponding to the
OpenDJ password policy property
<
literal>lockout-duration</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdMaxFailure</
literal>, corresponding to the
OpenDJ password policy property
<
literal>lockout-failure-count</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdFailureCountInterval</
literal>, corresponding
to the OpenDJ password policy property
<
literal>lockout-failure-expiration-interval</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdMaxAge</
literal>, corresponding to the OpenDJ
<
literal>max-password-age</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdMinAge</
literal>, corresponding to the OpenDJ
<
literal>min-password-age</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdAttribute</
literal>, corresponding to the
OpenDJ password policy property
<
literal>password-attribute</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdSafeModify</
literal>, corresponding to the
OpenDJ password policy property
<
literal>password-change-requires-current-password</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdExpireWarning</
literal>, corresponding to the
OpenDJ password policy property
<
literal>password-expiration-warning-interval</
literal></
para></
listitem>
<
listitem><
para><
literal>pwdInHistory</
literal>, corresponding to the
OpenDJ password policy property
<
literal>password-history-count</
literal></
para></
listitem>
<
para>The following Internet-Draft password policy attributes are not
taken into account by OpenDJ.</
para>
<
para><
literal>pwdCheckQuality</
literal>, as OpenDJ has password
validators. You can set password validators to use in the default
<
para><
literal>pwdMinLength</
literal>, as this is handled by the Length
Based Password Validator. You can configure this as part of the
default password policy.</
para>
<
para><
literal>pwdLockout</
literal>, as OpenDJ can deduce whether
lockout is configured based on the values of other lockout-related
password policy attributes.</
para>
<
para>Values of the following properties are inherited from the default
password policy for Internet-Draft based password policies.</
para>
<
listitem><
para><
literal>account-status-notification-handlers</
literal></
para></
listitem>
<
listitem><
para><
literal>allow-expired-password-changes</
literal></
para></
listitem>
<
listitem><
para><
literal>allow-multiple-password-values</
literal></
para></
listitem>
<
listitem><
para><
literal>allow-pre-encoded-passwords</
literal></
para></
listitem>
<
listitem><
para><
literal>default-password-storage-schemes</
literal></
para></
listitem>
<
listitem><
para><
literal>deprecated-password-storage-schemes</
literal></
para></
listitem>
<
listitem><
para><
literal>expire-passwords-without-warning</
literal></
para></
listitem>
<
listitem><
para><
literal>force-change-on-add</
literal></
para></
listitem>
<
listitem><
para><
literal>idle-lockout-interval</
literal></
para></
listitem>
<
listitem><
para><
literal>last-login-time-attribute</
literal></
para></
listitem>
<
listitem><
para><
literal>last-login-time-format</
literal></
para></
listitem>
<
listitem><
para><
literal>max-password-reset-age</
literal></
para></
listitem>
<
listitem><
para><
literal>password-generator</
literal></
para></
listitem>
<
listitem><
para><
literal>password-history-duration</
literal></
para></
listitem>
<
listitem><
para><
literal>password-validators</
literal></
para></
listitem>
<
listitem><
para><
literal>previous-last-login-time-formats</
literal></
para></
listitem>
<
listitem><
para><
literal>require-change-by-time</
literal></
para></
listitem>
<
listitem><
para><
literal>require-secure-authentication</
literal></
para></
listitem>
<
listitem><
para><
literal>require-secure-password-changes</
literal></
para></
listitem>
<
listitem><
para><
literal>skip-validation-for-administrators</
literal></
para></
listitem>
<
listitem><
para><
literal>state-update-failure-policy</
literal></
para></
listitem>
If you would rather specify password validators for your policy,
you can configure password validators for a subentry password policy
by adding the auxiliary object class <
literal>pwdValidatorPolicy</
literal>
and setting the multi-valued attribute,
<
literal>ds-cfg-password-validator</
literal>,
to the DNs of the password validator configuration entries.
The following example shows a subentry password policy
that references two password validator configuration entries.
The Character Set password validator determines
whether a proposed password is acceptable
by checking whether it contains a sufficient number of characters
from one or more user-defined character sets and ranges.
The Length-Based password validator determines
whether a proposed password is acceptable
based on whether the number of characters it contains
falls within an acceptable range of values.
Both are enabled in the default OpenDJ directory server configuration.
<
programlisting language="ldif">
dn: cn=Subentry Password Policy with Validators,dc=example,dc=com
objectClass: pwdValidatorPolicy
cn: Subentry Password Policy with Validators
pwdAttribute: userPassword
pwdFailureCountInterval: 300
ds-cfg-password-validator: cn=Character Set,cn=Password Validators,cn=config
ds-cfg-password-validator: cn=Length-Based Password Validator,
cn=Password Validators,cn=config
subtreeSpecification: {base "ou=people", specificationFilter
"(isMemberOf=cn=Directory Administrators,ou=Groups,dc=example,dc=com)" }
If a referenced password validator cannot be found,
then OpenDJ directory server logs an error message
when the password policy is invoked.
This can occur for example when a subentry password policy is replicated
to a directory server where the password validator is not (yet) configured.
In that case when a user attempts to change their password,
the server fails to find the referenced password validator.
See also <
xref linkend="create-repl-pwp" />.
<
section xml:
id="pwp-application">
<
title>Which Password Policy Applies</
title>
<
para>The password policy that applies to a user is identified by the
operational attribute, <
literal>pwdPolicySubentry</
literal>.</
para>
$ <
userinput>ldapsearch --port 1389 --baseDN dc=example,dc=com uid=bjensen pwdPolicySubentry</
userinput>
<
computeroutput>dn: uid=bjensen,ou=People,dc=example,dc=com
pwdPolicySubentry: cn=Default Password Policy,cn=Password Policies,cn=config</
computeroutput>
<
section xml:
id="configure-pwp">
<
title>Configuring Password Policies</
title>
<
para>You configure server based password policies using the
<
command>dsconfig</
command> command. Notice that server based password
policies are part of the server configuration, and therefore not replicated.
Alternatively, you can configure a subset of password policy features using
subentry based password policies that are stored with the replicated
server data. This section covers both server based and subentry based
password policies.</
para>
<
procedure xml:
id="default-pwp">
<
title>To Adjust the Default Password Policy</
title>
<
primary>Password policy</
primary>
<
secondary>Default</
secondary>
<
para>You can reconfigure the default password policy for example to
enforce password expiration, check that passwords do not match dictionary
words, and prevent password reuse. This default policy is a server based
<
para>Enable the appropriate password validator.</
para>
set-password-validator-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--validator-name Dictionary \
--set check-substrings:true \
--set min-substring-length:4 \
<
para>Apply the changes to the default password policy.</
para>
set-password-policy-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Default Password Policy" \
--set max-password-age:90d \
--set min-password-age:4w \
--set password-history-count:7 \
--set password-validator:Dictionary \
--no-prompt</
userinput></
screen>
<
para>Check your work.</
para>
get-password-policy-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Default Password Policy"</
userinput>
<
computeroutput>Property : Value(s)
------------------------------------------:--------------------------
account-status-notification-handler : -
allow-expired-password-changes : false
allow-user-password-changes : true
default-password-storage-scheme : Salted SHA-1
deprecated-password-storage-scheme : -
expire-passwords-without-warning : false
force-change-on-add : false
force-change-on-reset : false
idle-lockout-interval : 0 s
last-login-time-attribute : -
last-login-time-format : -
lockout-failure-count : 0
lockout-failure-expiration-interval : 0 s
max-password-age : 12 w 6 d
max-password-reset-age : 0 s
password-attribute : userpassword
password-change-requires-current-password : false
password-expiration-warning-interval : 5 d
password-generator : Random Password Generator
password-history-count : 7
password-history-duration : 0 s
password-validator : Dictionary
previous-last-login-time-format : -
require-change-by-time : -
require-secure-authentication : false
require-secure-password-changes : false</
computeroutput>
<
procedure xml:
id="create-per-server-pwp">
<
title>To Create a Server Based Password Policy</
title>
<
para>You can add a password policy for example for new users who have not
yet used their credentials to bind.</
para>
<
para>Create the new password policy.</
para>
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "New Account Password Policy" \
--set default-password-storage-scheme:"Salted SHA-1" \
--set force-change-on-add:true \
--set password-attribute:userPassword \
<
para>Check your work.</
para>
get-password-policy-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "New Account Password Policy"</
userinput>
<
computeroutput>Property : Value(s)
------------------------------------------:-------------
account-status-notification-handler : -
allow-expired-password-changes : false
allow-user-password-changes : true
default-password-storage-scheme : Salted SHA-1
deprecated-password-storage-scheme : -
expire-passwords-without-warning : false
force-change-on-add : true
force-change-on-reset : false
idle-lockout-interval : 0 s
last-login-time-attribute : -
last-login-time-format : -
lockout-failure-count : 0
lockout-failure-expiration-interval : 0 s
max-password-reset-age : 0 s
password-attribute : userpassword
password-change-requires-current-password : false
password-expiration-warning-interval : 5 d
password-history-count : 0
password-history-duration : 0 s
previous-last-login-time-format : -
require-change-by-time : -
require-secure-authentication : false
require-secure-password-changes : false</
computeroutput>
<
para>If you use a password policy like this, you might want to change the
user's policy again when the new user successfully updates the
<
procedure xml:
id="create-repl-pwp">
<
title>To Create a Subentry Based Password Policy</
title>
<
para>You can add a subentry to configure a password policy that
applies to Directory Administrators.</
para>
<
para>Create the entry that specifies the password policy.</
para>
<
computeroutput>dn: cn=Subentry Password Policy,dc=example,dc=com
cn: Subentry Password Policy
pwdAttribute: userPassword
pwdFailureCountInterval: 300
subtreeSpecification: {base "ou=people", specificationFilter
"(isMemberOf=cn=Directory Administrators,ou=Groups,dc=example,dc=com)" }</
computeroutput>
<
para>Add the policy to the directory.</
para>
$ <
userinput>ldapmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
<
computeroutput>Processing ADD request for cn=Subentry Password Policy,dc=example,dc=com
ADD operation successful for DN cn=Subentry Password Policy,dc=example,dc=com</
computeroutput>
<
para>Check that the policy applies as specified.</
para>
<
para>In the example, the policy should apply to a Directory Administrator,
while a normal user has the default password policy. Here, Kirsten Vaughan
is a member of the Directory Administrators group, and Babs Jensen is not
$ <
userinput>ldapsearch \
--baseDN dc=example,dc=com \
pwdPolicySubentry</
userinput>
<
computeroutput>dn: uid=kvaughan,ou=People,dc=example,dc=com
pwdPolicySubentry: cn=Subentry Password Policy,dc=example,dc=com</
computeroutput>
$ <
userinput>ldapsearch \
--baseDN dc=example,dc=com \
pwdPolicySubentry</
userinput>
<
computeroutput>dn: uid=bjensen,ou=People,dc=example,dc=com
pwdPolicySubentry: cn=Default Password Policy,cn=Password Policies,cn=config</
computeroutput>
<
section xml:
id="assign-pwp">
<
title>Assigning Password Policies</
title>
<
para>You assign subentry based password policies for a subtree of the DIT by
adding the policy to an LDAP subentry whose immediate superior is the root of
the subtree. In other words you can add the subtree based password policy
under <
literal>ou=People,dc=example,dc=com</
literal>, to have it apply to all
entries under <
literal>ou=People,dc=example,dc=com</
literal>. You can further
use the capabilities of LDAP <
link the scope of application.</
para>
<
para>You assign server based password policies by using the
<
literal>ds-pwp-password-policy-dn</
literal> attribute.</
para>
<
procedure xml:
id="assign-pwp-to-individual">
<
title>To Assign a Password Policy to a User</
title>
<
para>Prevent users from selecting their own password policy.</
para>
<
computeroutput>dn: ou=People,dc=example,dc=com
aci: (target ="ldap:///uid=*,ou=People,dc=example,dc=com")(targetattr =
"ds-pwp-password-policy-dn")(version 3.0;acl "Cannot choose own pass
word policy";deny (write)(userdn = "ldap:///self");)</
computeroutput>
$ <
userinput>ldapmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
<
computeroutput>Processing MODIFY request for ou=People,dc=example,dc=com
MODIFY operation successful for DN ou=People,dc=example,dc=com</
computeroutput>
<
para>Update the user's <
literal>ds-pwp-password-policy-dn</
literal>
<
computeroutput>dn: uid=newuser,ou=People,dc=example,dc=com
objectClass: organizationalPerson
objectClass: inetOrgPerson
mail: newuser@example.com
ds-pwp-password-policy-dn: cn=New Account Password Policy,cn=Password Policies,
cn=config</
computeroutput>
$ <
userinput>ldapmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
<
computeroutput>Processing ADD request for uid=newuser,ou=People,dc=example,dc=com
ADD operation successful for DN uid=newuser,ou=People,dc=example,dc=com</
computeroutput>
<
para>Check your work.</
para>
$ <
userinput>ldapsearch \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--baseDN dc=example,dc=com \
pwdPolicySubentry</
userinput>
<
computeroutput>dn: uid=newuser,ou=People,dc=example,dc=com
pwdPolicySubentry: cn=New Account Password Policy,cn=Password Policies,cn=config</
computeroutput>
<
procedure xml:
id="assign-pwp-to-group">
<
title>To Assign a Password Policy to a Group</
title>
<
para>Create a subentry defining the collective attribute that sets the
<
literal>ds-pwp-password-policy-dn</
literal> attribute for group
<
computeroutput>dn: cn=Password Policy for Dir Admins,dc=example,dc=com
objectClass: collectiveAttributeSubentry
objectClass: extensibleObject
cn: Password Policy for Dir Admins
ds-pwp-password-policy-dn;collective: cn=Root Password Policy,cn=Pass
subtreeSpecification: { base "ou=People", specificationFilter "(isMemberOf=
cn=Directory Administrators,ou=Groups,dc=example,dc=com)"}</
computeroutput>
$ <
userinput>ldapmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
<
computeroutput>Processing ADD request for cn=Password Policy for Dir Admins,dc=example,dc=com
ADD operation successful for DN cn=Password Policy for Dir
Admins,dc=example,dc=com</
computeroutput></
screen>
<
para>Check your work.</
para>
$ <
userinput>ldapsearch \
--baseDN dc=example,dc=com \
pwdPolicySubentry</
userinput>
<
computeroutput>dn: uid=kvaughan,ou=People,dc=example,dc=com
pwdPolicySubentry: cn=Root Password Policy,cn=Password Policies,cn=config</
computeroutput>
<
procedure xml:
id="assign-pwp-for-branch">
<
title>To Assign Password Policy for an Entire Branch</
title>
You can use a collective attribute to assign a password policy
to the entries under a base DN.
Create a password policy and collective attribute subentry
to assign the policy to all entries under a base DN.
The following example creates a password policy,
and then assigns that policy to entries
under <
literal>ou=People,dc=example,dc=com</
literal>.
<
computeroutput>dn: cn=People Password Policy,dc=example,dc=com
cn: People Password Policy
pwdAttribute: userPassword
pwdFailureCountInterval: 300
dn: cn=Assign People Password Policy,dc=example,dc=com
objectClass: extensibleObject
objectClass: collectiveAttributeSubentry
cn: Assign People Password Policy
ds-pwp-password-policy-dn;collective: cn=People Password Policy,dc=example,dc=com
subtreeSpecification: { base "ou=people" }
$ <
userinput>ldapmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
<
computeroutput>Processing ADD request for cn=People Password Policy,dc=example,dc=com
ADD operation successful for DN cn=People Password Policy,dc=example,dc=com
Processing ADD request for cn=Assign People Password Policy,dc=example,dc=com
ADD operation successful for DN
cn=Assign People Password Policy,dc=example,dc=com</
computeroutput>
Notice the subtree specification used to assign the policy,
<
literal>{ base "ou=people" }</
literal>.
You can relax the subtree specification value to <
literal>{}</
literal>
to apply the password policy to all entries
the parent of the subentry, <
literal>dc=example,dc=com</
literal>,
or further restrict the subtree specification
by adding a <
literal>specificationFilter</
literal>.
See <
link xlink:
show="new" xlink:
href="admin-guide#collective-attributes" >Collective Attributes</
citetitle></
link> for more information.
$ <
userinput>ldapsearch \
--baseDN dc=example,dc=com \
pwdPolicySubentry</
userinput>
<
computeroutput>dn: uid=alutz,ou=People,dc=example,dc=com
pwdPolicySubentry: cn=People Password Policy,dc=example,dc=com</
computeroutput>
If everything is correctly configured,
then the password policy should be assigned to users
whose entries are under <
literal>ou=People,dc=example,dc=com</
literal>.
<
section xml:
id="configure-pwd-generation">
<
title>Configuring Password Generation</
title>
<
primary>Passwords</
primary>
<
secondary>Generating</
secondary>
<
para>Password generators are used by OpenDJ during the LDAP password modify
extended operation to construct a new password for the user. In other words,
a directory administrator resetting a user's password can have OpenDJ
directory server generate the new password.</
para>
$ <
userinput>ldappasswordmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--authzID "u:bjensen"</
userinput>
<
computeroutput>The LDAP password modify operation was successful
Generated Password: eak77qdi</
computeroutput>
<
para>The default password policy shown in <
xref linkend="default-pwp" /> uses
the Random Password Generator.</
para>
get-password-policy-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Default Password Policy" \
--property password-generator</
userinput>
<
computeroutput>Property : Value(s)
-------------------:--------------------------
password-generator : Random Password Generator</
computeroutput>
get-password-generator-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--generator-name "Random Password Generator" \
--property password-generator</
userinput>
<
computeroutput> Property : Value(s)
-----------------------:-----------------------------------------------------
password-character-set : alpha:abcdefghijklmnopqrstuvwxyz, numeric:0123456789
password-format : "alpha:3,numeric:2,alpha:3"</
computeroutput>
<
para>Notice that the default configuration for the Random Password Generator
defines two <
literal>password-character-set</
literal> values, and then uses
those definitions in the <
literal>password-format</
literal> so that generated
passwords have eight characters: three from the <
literal>alpha</
literal> set,
followed by two from the <
literal>numeric</
literal> set, followed by three
from the <
literal>alpha</
literal> set. The
<
literal>password-character-set</
literal> name must be ASCII.</
para>
<
para>To set the password generator that OpenDJ employs when constructing a
new password for a user, set the <
literal>password-generator</
literal>
property for the password policy that applies to the user.</
para>
<
para>The following example does not change the password policy, but instead
changes the Random Password Generator configuration, and then demonstrates a
password being generated upon reset.</
para>
set-password-generator-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--generator-name "Random Password Generator" \
--remove password-character-set:alpha:abcdefghijklmnopqrstuvwxyz \
password-character-set:alpha:ABCDEFGHIJKLMNOPQRSTUVWabcdefghijklmnopqrstuvwxyz \
--add password-character-set:punct:,./\`!@#\$%^&*:\;[]\"\'\(\)+=-_~\\ \
password-format:alpha:3,punct:1,numeric:2,punct:2,numeric:3,alpha:3,punct:2 \
$ <
userinput>ldappasswordmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--authzID "u:bjensen"</
userinput>
<
computeroutput>The LDAP password modify operation was successful
Generated Password: pld^06:)529HTq$'</
computeroutput>
<
para>If you also set up a password validator in the password policy as
shown in <
xref linkend="default-pwp" /> and further described in
<
xref linkend="configure-pwd-validation" />, make sure the generated
passwords are acceptable to the validator.</
para>
<
section xml:
id="configure-pwd-storage">
<
title>Configuring Password Storage</
title>
<
primary>Passwords</
primary>
<
secondary>Storage schemes</
secondary>
<
para>Password storage schemes encode new passwords provided by users so that
they are stored in an encoded manner. This makes it difficult or impossible
for someone to determine the clear-text passwords from the encoded
values. Password storage schemes also determine whether a clear-text password
provided by a client matches the encoded value stored in the server.</
para>
<
para>OpenDJ offers a variety of both reversible and one-way password storage
schemes. Some schemes make it easy to recover the clear-text password,
whereas others aim to make it computationally hard to do so.</
para>
list-password-storage-schemes \
--bindDN "cn=Directory Manager" \
--bindPassword password</
userinput>
Password Storage Scheme : Type : enabled
------------------------:---------------:--------
Blowfish : blowfish : true
Salted MD5 : salted-md5 : true
Salted SHA-1 : salted-sha1 : true
Salted SHA-256 : salted-sha256 : true
Salted SHA-384 : salted-sha384 : true
Salted SHA-512 : salted-sha512 : true
SHA-1 : sha1 : true</
computeroutput>
<
para>As shown in <
xref linkend="default-pwp" />, the default password storage
scheme for users in Salted SHA-1. When you add users or import user entries
with <
literal>userPassword</
literal> values in clear text, OpenDJ hashes them
with the default password storage scheme. Root DN users have a different
password policy by default, shown in <
xref linkend="assign-pwp-to-group" />.
The Root Password Policy uses Salted SHA-512 by default.</
para>
<
para>You change the default password policy storage scheme for users by
changing the applicable password policy, as shown in the following
set-password-policy-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Default Password Policy" \
--set default-password-storage-scheme:pbkdf2 \
<
para>Notice that the change in default password storage scheme does not
cause OpenDJ to update any stored password values. By default, OpenDJ only
stores a password with the new storage scheme the next time that the password
<
para>OpenDJ prefixes passwords with the scheme used to encode them, which
means it is straightforward to see which password storage scheme is in use.
After the default password storage scheme is changed to PBKDF2, old user
passwords remain encoded with Salted SHA-1.</
para>
$ <
userinput>ldapsearch \
--bindDN uid=bjensen,ou=people,dc=example,dc=com \
--bindPassword hifalutin \
--baseDN dc=example,dc=com \
"(uid=bjensen)" userPassword</
userinput>
<
computeroutput>dn: uid=bjensen,ou=People,dc=example,dc=com
userPassword: {SSHA}Rc3tkAj1qP5zGiRkwDIWDFxrxpGgO8Fwh3aibg==</
computeroutput>
<
para>When the password is changed, the new default password storage scheme
takes effect, as shown in the following example.</
para>
$ <
userinput>ldappasswordmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--newPassword changeit</
userinput>
<
computeroutput>The LDAP password modify operation was successful</
computeroutput>
$ <
userinput>ldapsearch \
--bindDN uid=bjensen,ou=people,dc=example,dc=com \
--bindPassword changeit \
--baseDN dc=example,dc=com \
"(uid=bjensen)" userPassword</
userinput>
<
computeroutput>dn: uid=bjensen,ou=People,dc=example,dc=com
userPassword: {PBKDF2}10000:O3V6G7y7n7AefOkRGNKQ5ukrMuO5uf+iEQ9ZLg==</
computeroutput>
<
para>When you change the password storage scheme for users, realize that
the user passwords must change in order for OpenDJ to encode them with
the chosen storage scheme. If you are changing the storage scheme because
the old scheme was too weak, then you no doubt want users to change their
<
para>If however the storage scheme change is not related to vulnerability,
you can use the <
literal>deprecated-password-storage-scheme</
literal>
property of the password policy to have OpenDJ store the password in the new
format after successful authentication. This makes it possible to do password
migration for active users without forcing users to change their
$ <
userinput>ldapsearch \
--bindDN uid=kvaughan,ou=people,dc=example,dc=com \
--baseDN dc=example,dc=com \
"(uid=kvaughan)" userPassword</
userinput>
<
computeroutput>dn: uid=kvaughan,ou=People,dc=example,dc=com
userPassword: {SSHA}hDgK44F2GhIIZj913b+29Ak7phb9oU3Lz4ogkg==</
computeroutput>
set-password-policy-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Default Password Policy" \
--set deprecated-password-storage-scheme:"Salted SHA-1" \
$ <
userinput>ldapsearch \
--bindDN uid=kvaughan,ou=people,dc=example,dc=com \
--baseDN dc=example,dc=com \
"(uid=kvaughan)" userPassword</
userinput>
<
computeroutput>dn: uid=kvaughan,ou=People,dc=example,dc=com
userPassword: {PBKDF2}10000:L4dCYqSsNnf47YZ3a6aC8K2E3DChhHHhpcoUzg==</
computeroutput>
<
para>Notice that with <
literal>deprecated-password-storage-scheme</
literal>
set appropriately, Kirsten Vaughan's password was hashed again after she
authenticated successfully.</
para>
<
section xml:
id="configure-pwd-validation">
<
title>Configuring Password Validation</
title>
<
primary>Passwords</
primary>
<
secondary>Validating</
secondary>
<
para>Password validators are responsible for determining whether a proposed
password is acceptable for use and can run checks like ensuring the password
meets minimum length requirements, that it has an appropriate range of
characters, or that it is not in the history. OpenDJ directory server
provides a variety of password validators.</
para>
list-password-validators \
--bindDN "cn=Directory Manager" \
--bindPassword password</
userinput>
Password Validator : Type : enabled
------------------------------------:---------------------:--------
Attribute Value : attribute-value : true
Character Set : character-set : true
Dictionary : dictionary : false
Length-Based Password Validator : length-based : true
Repeated Characters : repeated-characters : true
Similarity-Based Password Validator : similarity-based : true
Unique Characters : unique-characters : true</
computeroutput>
<
para>The password policy for a user specifies the set of password validators
that should be used whenever that user provides a new password. By default
no password validators are configured. You can see an example setting the
Default Password Policy to use the Dictionary validator in
<
xref linkend="default-pwp" />. The following example shows how to set up
a custom password validator and assign it to the default password
<
para>The custom password validator ensures passwords meet at least three of
the following four criteria. Passwords are composed of:</
para>
<
para>English lowercase characters (a through z)</
para>
<
para>English uppercase characters (A through Z)</
para>
<
para>Base 10 digits (0 through 9)</
para>
<
para>Non-alphabetic characters (for example, !, $, #, %)</
para>
<
para>Notice how the <
literal>character-set</
literal> values are constructed.
The initial <
literal>0:</
literal> means the set is optional, whereas
<
literal>1:</
literal> would mean the set is required.</
para>
create-password-validator \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--validator-name "Custom Character Set Password Validator" \
--set allow-unclassified-characters:true \
--set character-set:0:abcdefghijklmnopqrstuvwxyz \
--set character-set:0:ABCDEFGHIJKLMNOPQRSTUVWXYZ \
--set character-set:0:0123456789 \
--set character-set:0:!\"#\$%&\'\(\)*+,-./:\;\\<=\>?@[\\]^_\`{\|}~ \
--set min-character-sets:3 \
set-password-policy-prop \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Default Password Policy" \
--set password-validator:"Custom Character Set Password Validator" \
$ <
userinput>ldappasswordmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--newPassword '!ABcd$%^'</
userinput>
<
para>In the preceding example, the character set of ASCII punctuation,
<
literal>!\"#\$%&\'\(\)*+,-./:\;\\<=\>?@[\\]^_\`{\|}~</
literal>,
is hard to read because of all the escape characters. In practice it can
be easier to enter sequences like that by using <
command>dsconfig</
command>
in interactive mode, and letting it do the escaping for you. You can also
use the <
option>--commandFilePath {path}</
option> option to save the result
of your interactive session to a file for use in scripts later.</
para>
<
para>An attempt to set an invalid password fails as shown in the following
$ <
userinput>ldappasswordmodify \
--bindDN "cn=Directory Manager" \
--bindPassword password \
--newPassword hifalutin</
userinput>
<
computeroutput>The LDAP password modify operation failed with result code 19
Error Message: The provided new password failed the validation checks defined
in the server: The provided password did not contain characters from at least
3 of the following character sets or ranges: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',
'!"#$%&'()*+,-./:;<=\>?@[\]^_`{|}~', '0123456789', 'abcdefghijklmnopqrstuvwxyz'</
computeroutput>
<
para>Validation does not affect existing passwords, but only takes effect
when the password is updated.</
para>
You can reference password validators from subentry password policies.
See <
xref linkend="pwp-replicated" /> for an example.
<
section xml:
id="sample-password-policies">
<
title>Sample Password Policies</
title>
The sample password policies in this section demonstrate
OpenDJ server based password policies for several common cases.
<
primary>Password policy</
primary>
<
secondary>Samples</
secondary>
<
xref linkend="example-enforce-regular-password-changes" />
<
xref linkend="example-track-last-login" />
<
xref linkend="example-deprecate-storage-scheme" />
<
xref linkend="example-lock-idle-accounts" />
<
xref linkend="example-allow-grace-login" />
<
xref linkend="example-require-password-change-on-add-or-reset" />
<
example xml:
id="example-enforce-regular-password-changes">
<?
dbfo keep-
together="auto"?>
<
title>Enforce Regular Password Changes</
title>
The following commands configure an OpenDJ server based password policy
that sets age limits on passwords, requiring that they change periodically.
It also sets the number of passwords to keep in the password history
of the entry, thereby preventing users from reusing the same password
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Enforce Regular Password Changes" \
--set default-password-storage-scheme:"Salted SHA-1" \
--set password-attribute:userPassword \
--set max-password-age:13w \
--set min-password-age:4w \
--set password-history-count:7 \
See also <
xref linkend="assign-pwp" /> for instructions on using the policy.
<
example xml:
id="example-track-last-login">
<?
dbfo keep-
together="auto"?>
<
title>Track Last Login Time</
title>
The following commands configure an OpenDJ server based password policy
that keeps track of the last successful login.
First, set up an attribute to which OpenDJ directory server
can write a timestamp value on successful login.
For additional information also see the example, <
link xlink:
href="admin-guide#configure-account-lockout" ><
citetitle>Search: List Active Accounts</
citetitle></
link>.
$ <
userinput>ldapmodify \
--bindDN "cn=Directory Manager" \
attributeTypes: ( lastLoginTime-oid
DESC 'Last time the user logged in'
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
X-ORIGIN 'OpenDJ example documentation' )</
userinput>
<
computeroutput>Processing MODIFY request for cn=schema
MODIFY operation successful for DN cn=schema</
computeroutput>
Next, create the password policy that causes OpenDJ directory server
to write the timestamp to the attribute on successful login.
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Track Last Login Time" \
--set default-password-storage-scheme:"Salted SHA-1" \
--set password-attribute:userPassword \
--set last-login-time-attribute:lastLoginTime \
--set last-login-time-format:"yyyyMMddHH'Z'" \
See also <
xref linkend="assign-pwp" /> for instructions on using the policy.
<
example xml:
id="example-deprecate-storage-scheme">
<?
dbfo keep-
together="auto"?>
<
title>Deprecate a Password Storage Scheme</
title>
The following commands configure an OpenDJ server based password policy
that you can use when deprecating a password storage scheme.
This policy uses elements from
<
xref linkend="example-enforce-regular-password-changes" />,
as OpenDJ directory server only employs the new password storage scheme
to hash or to encrypt passwords when a password changes.
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Deprecate a Password Storage Scheme" \
--set deprecated-password-storage-scheme:Crypt \
--set default-password-storage-scheme:"Salted SHA-1" \
--set password-attribute:userPassword \
--set max-password-age:13w \
--set min-password-age:4w \
--set password-history-count:7 \
See also <
xref linkend="assign-pwp" /> for instructions on using the policy.
<
example xml:
id="example-lock-idle-accounts">
<?
dbfo keep-
together="auto"?>
<
title>Lock Idle Accounts</
title>
The following commands configure an OpenDJ server based password policy
that locks idle accounts.
This policy extends the example from
<
xref linkend="example-track-last-login" />
as OpenDJ directory server must track last successful login time
in order to calculate how long the account has been idle.
You must first add the <
literal>lastLoginTime</
literal> attribute type
in order for OpenDJ directory server to accept this new password policy.
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Lock Idle Accounts" \
--set default-password-storage-scheme:"Salted SHA-1" \
--set password-attribute:userPassword \
--set last-login-time-attribute:lastLoginTime \
--set last-login-time-format:"yyyyMMddHH'Z'" \
--set idle-lockout-interval:13w \
See also <
xref linkend="assign-pwp" />,
and <
link xlink:
href="admin-guide#configure-account-lockout" ><
citetitle>Configuring Account Lockout</
citetitle></
link>.
<
example xml:
id="example-allow-grace-login">
<?
dbfo keep-
together="auto"?>
<
title>Allow Grace Login to Change Expired Password</
title>
The following commands configure an OpenDJ server based password policy
that allows users to login after their password has expired
in order to choose a new password.
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Allow Grace Login" \
--set default-password-storage-scheme:"Salted SHA-1" \
--set password-attribute:userPassword \
--set grace-login-count:2 \
See also <
xref linkend="assign-pwp" /> for instructions on using the policy.
<
example xml:
id="example-require-password-change-on-add-or-reset">
<?
dbfo keep-
together="auto"?>
<
title>Require Password Change on Add or Reset</
title>
The following commands configure an OpenDJ server based password policy
that requires new users to change their password
after logging in for the first time,
and also requires users to change their password
after their password is reset.
--bindDN "cn=Directory Manager" \
--bindPassword password \
--policy-name "Require Password Change on Add or Reset" \
--set default-password-storage-scheme:"Salted SHA-1" \
--set password-attribute:userPassword \
--set force-change-on-add:true \
--set force-change-on-reset:true \
See also <
xref linkend="assign-pwp" /> for instructions on using the policy.