{"id":5476,"date":"2020-04-17T22:14:07","date_gmt":"2020-04-17T19:14:07","guid":{"rendered":"https:\/\/kifarunix.com\/?p=5476"},"modified":"2024-03-14T20:20:57","modified_gmt":"2024-03-14T17:20:57","slug":"disable-password-expiry-for-specific-users-on-openldap","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/disable-password-expiry-for-specific-users-on-openldap\/","title":{"rendered":"Disable Password Expiry for Specific Users on OpenLDAP"},"content":{"rendered":"\n<p>How can I prevent password expiration for a single specific LDAP user like the LDAP administrator, the replication user, the bind DN user? Well, it is actually possible to disable password expiry for specific users on OpenLDAP. That is what we are going to cover on this guide.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Disabling OpenLDAP Password Expiry for Specific Users<\/h2>\n\n\n\n<p>In our previous guide, we learnt how to implement OpenLDAP password policies.<\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" href=\"https:\/\/kifarunix.com\/implement-openldap-password-policies\/\" target=\"_blank\">Implement OpenLDAP Password Policies<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Default Password Policy<\/h3>\n\n\n\n<p>In our demo system, we created an OU container for storing password policies called <strong><code>pwpolicy<\/code><\/strong>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapsearch -Y ExTERNAL -H ldapi:\/\/\/ -b dc=ldapmaster,dc=kifarunix-demo,dc=com \"(ou=pwpolicy)\" -LLL -Q<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code><strong>dn: ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong>\nobjectClass: organizationalUnit\nobjectClass: top\nou: pwpolicy<\/code><\/pre>\n\n\n\n<p>Within this container, we set up a subentry with the default password policies which applies to every other user in our OpenLDAP database.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapsearch -Y ExTERNAL -H ldapi:\/\/\/ -b ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com -LLL -Q \"(cn=default)\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code><strong>dn: cn=default,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong>\nobjectClass: person\nobjectClass: pwdPolicyChecker\nobjectClass: pwdPolicy\ncn: pwpolicy\ncn: default\nsn: pwpolicy\npwdAttribute: userPassword\npwdMinAge: 0\n<strong>pwdMaxAge: 5184000<\/strong>\npwdInHistory: 5\npwdCheckQuality: 2\npwdMinLength: 12\npwdExpireWarning: 432000\npwdGraceAuthNLimit: 5\npwdLockout: TRUE\npwdLockoutDuration: 0\npwdMaxFailure: 3\npwdFailureCountInterval: 0\npwdMustChange: TRUE\npwdAllowUserChange: TRUE\npwdSafeModify: FALSE<\/code><\/pre>\n\n\n\n<p>As you can see from our default password policies above, the password is set to expire after 60 days (<strong>5184000<\/strong> seconds).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Creating User Specific Password Policies on OpenLDAP<\/h3>\n\n\n\n<p>In order to apply specific password policies to a specific category of users on an OpenLDAP server, you need to create specific policies and assign them to the respective users.<\/p>\n\n\n\n<p>Assigning specific users specific password policies is made possible through the use of <strong><code>pwdPolicySubentry<\/code><\/strong> attribute.<\/p>\n\n\n\n<p>According to <a rel=\"noreferrer noopener\" href=\"https:\/\/linux.die.net\/man\/5\/slapo-ppolicy\" target=\"_blank\">man 5 slapo-ppolicy<\/a>.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-default td_pull_quote td_pull_center is-layout-flow wp-block-quote-is-layout-flow\">\n<p>Every account that should be subject to password policy control should have a&nbsp;<strong>pwdPolicySubentry<\/strong>&nbsp;attribute containing the DN of a valid&nbsp;<strong>pwdPolicy<\/strong>&nbsp;entry, or they can simply use the configured default. In this way different users may be managed according to different policies.<\/p>\n<\/blockquote>\n\n\n\n<amp-fit-text class=\"is-layout-flow wp-block-quote-is-layout-flow\" layout=\"fixed-height\" min-font-size=\"6\" max-font-size=\"72\" height=\"80\"><blockquote class=\"wp-block-quote td_pull_quote td_pull_center\"><p>This attribute refers directly to the&nbsp;<strong>pwdPolicy<\/strong>&nbsp;subentry that is to be used for this particular directory user. If&nbsp;<strong>pwdPolicySubentry<\/strong>&nbsp;exists, it must contain the DN of a valid&nbsp;<strong>pwdPolicy<\/strong>&nbsp;object. If it does not exist, the&nbsp;<strong>ppolicy<\/strong>&nbsp;module will enforce the default password policy rules on the user associated with this authenticating DN. If there is no default, or the referenced subentry does not exist, then no policy rules will be enforced.<\/p><\/blockquote><\/amp-fit-text>\n\n\n\n<p>Therefore, create an entry with specific password policies. For example, to create a policy that sets the password to not expire, create a DN entry with policies similar to the one below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim pwd_no_expire.ldif<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code><strong>dn: cn=pwd-no-expire,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong>\nobjectClass: person\nobjectClass: pwdPolicyChecker\nobjectClass: pwdPolicy\ncn: pwpolicy\ncn: <strong>pwd-no-expire<\/strong>\nsn: pwpolicy\npwdAttribute: userPassword\npwdMinAge: 0\npwdMaxAge: 0\npwdInHistory: 5\npwdCheckQuality: 1\npwdMinLength: 12\npwdLockout: TRUE\npwdLockoutDuration: 0\npwdMaxFailure: 3\npwdFailureCountInterval: 0<\/code><\/pre>\n\n\n\n<p>Note that we created a subentry, <strong>cn=pwd-no-expire,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong>, with no password age limit (<code>pwdMaxAge: 0<\/code>).<\/p>\n\n\n\n<p>According to <code><strong>man slapo-ppolicy<\/strong><\/code>, the <strong><code>pwdMaxAge<\/code><\/strong> attribute contains the number of seconds after which a modified password will expire. <strong>If this attribute is not present, or if its<br>value is zero (0), then passwords will not expire.<\/strong><\/p>\n\n\n\n<p>Update the OpenLDAP database with your policies now;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapadd -Y EXTERNAL -H ldapi:\/\/\/ -f pwd_no_expire.ldif<\/code><\/pre>\n\n\n\n<p>You now have two policies, the default and let&#8217;s call it user specific policies.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapsearch -Y ExTERNAL -H ldapi:\/\/\/ -b ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com -LLL -Q<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>dn: ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com\nobjectClass: organizationalUnit\nobjectClass: top\nou: pwpolicy\n\n<strong>dn: cn=default,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong>\nobjectClass: person\nobjectClass: pwdPolicyChecker\nobjectClass: pwdPolicy\ncn: pwpolicy\ncn: default\nsn: pwpolicy\npwdAttribute: userPassword\npwdMinAge: 0\npwdInHistory: 5\npwdCheckQuality: 2\npwdMinLength: 12\npwdExpireWarning: 432000\npwdGraceAuthNLimit: 5\npwdLockout: TRUE\npwdLockoutDuration: 0\npwdMaxFailure: 3\npwdFailureCountInterval: 0\npwdMustChange: TRUE\npwdAllowUserChange: TRUE\npwdSafeModify: FALSE\n<strong>pwdMaxAge: 5184000<\/strong>\n\n<strong>dn: cn=pwd-no-expire,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong>\nobjectClass: person\nobjectClass: pwdPolicyChecker\nobjectClass: pwdPolicy\ncn: pwpolicy\ncn: pwd-no-expire\nsn: pwpolicy\npwdAttribute: userPassword\npwdMinAge: 0\n<strong>pwdMaxAge: 0<\/strong>\npwdInHistory: 5\npwdCheckQuality: 1\npwdMinLength: 12\npwdLockout: TRUE\npwdLockoutDuration: 0\npwdMaxFailure: 3\npwdFailureCountInterval: 0<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Add User to New Password Policy<\/h3>\n\n\n\n<p>Now, add all users you want to disable password expiry for to the new no password expiry policy create above.<\/p>\n\n\n\n<p>In our demo, we have two user for demonstration purposes.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapsearch -Y ExTERNAL -H ldapi:\/\/\/ -b ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com -LLL -Q dn<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>dn: uid=janedoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\ndn: uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/code><\/pre>\n\n\n\n<p>We will add the user, <code><strong>janedoe<\/strong><\/code>, to the new created policy with no password age limit defined (<code>cn=pwd-no-expire,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/code>) by modifying its attributes and adding the <code><strong>pwdPolicySubentry<\/strong><\/code> which we gonna point it to the new policy as shown below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim janedoe.ldif<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>dn: uid=janedoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\nchangetype: modify\n<strong>add: pwdPolicySubentry\npwdPolicySubentry: <strong>cn=pwd-no-expire,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong><\/strong><\/code><\/pre>\n\n\n\n<p>Update user attributes;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapadd -Y EXTERNAL -H ldapi:\/\/\/ -f janedoe.ldif<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Verify Password Expiry Status<\/h3>\n\n\n\n<p>How can we verify that our user has been exempted from password expiry policy?<\/p>\n\n\n\n<p>To quickly demonstrate this, we will reduce the password maximum age to two minutes on the default policy so that the password expiry notification can be generated quickly without having to wait for the next 55 days as per our default policy to generate the notification.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim reduce-pwdmaxage.ldif<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code><strong>dn: cn=default,ou=pwpolicy,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong>\nchangetype: modify\nreplace: pwdMaxAge\npwdMaxAge: 120<\/code><\/pre>\n\n\n\n<p>Well, apart from comparing the value of <code>pwdChangedTime<\/code> to the value of&nbsp;<code>pwdMaxAge<\/code>&nbsp; to determine the password expiry date, let us try to verify user passwords using <code>ldapwhoami<\/code> command and check the logs in realtime.<\/p>\n\n\n\n<p>Next, we will reset the passwords for the two users above, <code>janedoe<\/code> and <code>johndoe<\/code>, as per the specified policies. After that, we can verify whether LDAP sets the password expiry information.<\/p>\n\n\n\n<p>To reset the passwords, run the command below on your OpenLDAP server. Replace the user entries accordingly;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldappasswd -H ldapi:\/\/\/ -Y EXTERNAL -S \"uid=janedoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\"<\/code><\/pre>\n\n\n\n<p>To be able to check the password expiry notification on the logs, verify your password with <code><strong>ldapwhoami<\/strong><\/code> command. While running these commands, open another terminal and tail the logs in real time;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapwhoami -h ldapmaster.kifarunix-demo.com -x -D \"uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\" -W<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ldapwhoami -h ldapmaster.kifarunix-demo.com -x -D \"uid=janedoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\" -W<\/code><\/pre>\n\n\n\n<p>Tailing the logs;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>tail -f \/var\/log\/slapd.log<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>Apr 17 23:54:24 ldapmaster slapd[4915]: conn=1003 fd=18 ACCEPT from IP=192.168.56.180:34722 (IP=0.0.0.0:389)\n<strong>Apr 17 23:54:24 ldapmaster slapd[4915]: conn=1003 op=0 BIND dn=\"uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\" method=128\nApr 17 23:54:24 ldapmaster slapd[4915]: conn=1003 op=0 BIND dn=\"uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\" mech=SIMPLE ssf=0\nApr 17 23:54:24 ldapmaster slapd[4915]: ppolicy_bind: Setting warning for password expiry for uid=johndoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com = 74 seconds<\/strong>\nApr 17 23:54:24 ldapmaster slapd[4915]: conn=1003 op=0 RESULT tag=97 err=0 text=\n...\n...\nApr 17 23:54:49 ldapmaster slapd[4915]: conn=1004 fd=18 ACCEPT from IP=192.168.56.180:34724 (IP=0.0.0.0:389)\n<strong>Apr 17 23:54:49 ldapmaster slapd[4915]: conn=1004 op=0 BIND dn=\"uid=janedoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\" method=128\nApr 17 23:54:49 ldapmaster slapd[4915]: conn=1004 op=0 BIND dn=\"uid=janedoe,ou=people,dc=ldapmaster,dc=kifarunix-demo,dc=com\" mech=SIMPLE ssf=0<\/strong>\nApr 17 23:54:49 ldapmaster slapd[4915]: conn=1004 op=0 RESULT tag=97 err=0 text=\nApr 17 23:54:49 ldapmaster slapd[4915]: conn=1004 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.3<\/code><\/pre>\n\n\n\n<p>As you can see from above logs, the password for the user, johndoe expiry warning is generated as it is using the default password policy with password maximum age set to 120 seconds.<\/p>\n\n\n\n<p>No password expiry notification is generated for user janedoe as it is using the password policy with no password expiry set.<\/p>\n\n\n\n<p>And that is how you can simply disable OpenLDAP password expiry for specific users on OpenLDAP server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Related Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/setup-openldap-master-master-replication-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\">Setup OpenLDAP Master-Master Replication on CentOS 8<\/a><\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" href=\"https:\/\/kifarunix.com\/configure-openldap-sssd-client-on-centos-6-7\/\" target=\"_blank\">Configure OpenLDAP SSSD client on CentOS 6\/7<\/a><\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" href=\"https:\/\/kifarunix.com\/setup-openldap-master-slave-replication-on-centos-8\/\" target=\"_blank\">Setup OpenLDAP Master-Slave Replication on CentOS 8<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/setup-ldap-self-service-password-tool-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\">Setup LDAP Self Service Password Tool on CentOS 8<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How can I prevent password expiration for a single specific LDAP user like the LDAP administrator, the replication user, the bind DN user? Well, it<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,285,1099],"tags":[1441,1444,1440,1442,1445],"class_list":["post-5476","post","type-post","status-publish","format-standard","hentry","category-howtos","category-directory-server","category-openldap","tag-disable-password-expiry-for-openldap-user","tag-enable-pwdpolicysubentry-openldap","tag-openldap-set-single-user-password-to-never-expire","tag-password-policies-openldap","tag-pwdpolicysubentry","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/5476"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=5476"}],"version-history":[{"count":6,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/5476\/revisions"}],"predecessor-version":[{"id":21373,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/5476\/revisions\/21373"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=5476"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=5476"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=5476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}