Re: Issue with grace logins and expired passwords
a...@novell.com
Hash: SHA1
I'm guessing you have somehow disabled the 'Update Login Attributes'
option within iMonitor. There was a bug (417104) with 8.8.3 where this
happened if you updated other settings even though you did not mean to.
To correct this go to iMonitor on each server you have (to verify it is
set or to set it depending on need as this is a server-specific setting),
Agent Configuration, Login Settings. Be sure the checkbox is set.
Anytime you go to Database Cache and make changes there be SURE you come
back to Login Settings to re-enable things. Better yet, upgrade to 8.8.5
to avoid this bug.
Good luck.
sjahan wrote:
> Hi,
>
> Here is our problem:
>
> We are working with eDir 8.8.3 installed on SLES10SP2.
>
> We're experiencing some important issues about logging when passwords
> have expired.
>
> We have tested with a default universal password policy, just
> activating a delay for expiration and some grace logins.
>
> For example: I set a user's password using iManager and admin account.
> According to our password policy, if the admin set the password, it's
> expired to force the user to change it himself. No trouble about that.
>
> After the admin reset the password, it's actually stored in eDir, the
> attribute password Expiration Time is updated with the current time,
> that is fine.
> There is 6 grace logins allowed, and 6 remaining.
>
> The issue comes right after that: the user can connect (using an LDAP
> client or UserApp 3.6.1) with the expired password, which is normal
> since he has some grace logins, but the remaining grace logins don't
> decrease.
> The user can connect forever with any remaining grace logins, without
> setting his own password.
>
> For a major part of the users, we do not even have the alert message
> prompting the number of remaining grace logins at the login.
>
> I found out that logging in with a user to iManager works fine:
> iManager asks the user to reset the password, and decrement properly the
> remaining grace logins.
>
> After that, the only thing which changes in the user data is the
> loginTime attribute which is set, and the number of remaining grace
> logins.
>
> After this log in to iManager, if we log in to UserApp, we got the
> alert message prompting the right number of remaining logins, but it
> still doesn't decrement it.
>
>
> Hoping you can help us since i really have no clue about why this
> doesn't work as configured,
>
> Best regards.
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJLcAdCAAoJEF+XTK08PnB5j/QP/2FcKSiMru7keGi0Pygcxc4X
V8plxW5jEyoocTt7km7yf0SpJ2l96PCJCETo90x60lg0L4azMB60pOgf/zcJxxhq
QIYggE7ndU3jd/kgRvBR3s/DXl5q1jY3fxx/5YbY7OSPZO3VZajv1QsROLUCNGO2
BS2PzF3Fh1iI5Hf2gc1yn6N9FkPWLnnZN6ibVNLk0grsAks7qHIRJg5PbD2Gb1JK
p5JXLQf2wEa9V53+2XAlphE0TWLFa6BKKjjkgxxbYrAavXe4meEhXjEhhGFp5RJG
LT/wwYNg/3YJF7ub59ieXm04vQ1WSwt/HJsDAWg9j4e88ej/ihjhDRUaScRtCAhS
FYEdk3NYA4liaFeb/Mrpuzj3K8EMSg6umPCMERZEi4rzhPmyISn5t+o7RYqRUob+
fmAud8f5zttkaxk59onWayjbec9CYOR8Y4CxygNsfurcsUvqxs+K1NxkS5Oq4W5r
v91jgafggEzFaQY5lkdl8173ujIasX4Qyf4uDHAjvh1/HnC3BDlnfQcInjhPzDqb
7tRpgeqEUtct4qF7spzNmZJVRce45JROISTWpjZ5jxTPdZT3VaWM9jNTQ/GN2gx4
vbM44djWvn08vqEzm2OcubqJFIPCv5MTvstDLUhfuy/O4zARpVxgVgalL4VYgc4i
3PPup+4Ulb7Ovgykhtb+
=rEGf
-----END PGP SIGNATURE-----
a...@novell.com
Hash: SHA1
DB Cache (bug) or you manually changing it are all I know of.
Good luck.
sjahan wrote:
> Thank you very much, that was exactly that thing!
> Just to be sure, what are the kind of actions which could access the
> database cache and reset this property? I don't go so often in DB cache
> or technical stuff like that, usually i only deploy schema and
> drivers...
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJLcCOuAAoJEF+XTK08PnB5prQP/R6AYpEndGqKF5XG7PF0zrwi
3OQjVz8BiUw0GuEhzwFOVfCcWzwKA7A9FzPEkGmnIavGzac5jcdthFodz7bkgDc4
QeuTtoFHFt8s8wCovUToPHZU9rGHJVdeUtpL6ZE9CdgLcpLBDV+z6RN94ke5coCr
qkDffzFqA39fsTeCsOjOEmI0YKura6QgwwXVN8UrqogQYfFjmwSJH20gwxfrzQLa
CjiwNigZQjZMXifiqnK6U4T1HT2cxAB1eJzGSgvuRKtz1Xc/+OByc0b8SkVcwuq5
3Q4imIJMY6zyhvuf5T/TgaYbr0M8f5xhArTDE53aIfyNTFLg883doGNYfhmjjOzS
ZeusxbCAtLlHQl7pxQIZUFNb88ivJUH7fEn71IsvzDoMbMo9SHpUjN7UGYWqVrQQ
0VPf5fPHr+gD7FNtNrVtVBJafdWwUk7hNbbLvdaWgJA3tVEyZzRWruYVup1x9P6s
z3PjxrmAHMJs8HUE2JJjwjyH1DCGDG6s/bZHemgubb0wuSs3BVnhiue+rTrURm2i
LmUAeR910el8n1sD+kPuS7saUEBmbIplwIrZKiZYFLZQh7oLhQWk9KoIY52iiGRe
bwukeVEWwHcWLji5TYuJ1GK+1c+OOV1fKl4oJb9d7xFOjyDqus1ZHOTwzMkIs4j+
TgHFMOKSL9pCi6KLlHis
=7roi
-----END PGP SIGNATURE-----