Assignment of custom password policies

In the documentation is well described how to assign a custom password policy using Roles and CoS. This technique is fairly flexible and can be applied to a number of situations. I have the fear that this is very costly in terms of performance.
Are there simpler ways to assign a password policy to all objects in a container?
Thank you,
Jo

We just did this same thing in one of our instances and have not seen any CPU usage increase, but it's a very small instance (only about 10,000 entries.
We just applied the password policy to all objects in the ou using the following template & COS
# Template user for Class of Service
dn: cn=AgencyTemplate,ou=agencies,o=company
objectClass: top
objectClass: extensibleObject
objectClass: costemplate
objectClass: ldapsubentry
cosPriority: 1
passwordPolicySubentry: cn=Agency Password Policy,o=company
cn: AgencyTemplate
# The COS to apply the policy to all agency users (ou=agencies,o=company)
dn: cn=AgcyPwdPol_cosDefinition,ou=agencies,o=company
objectClass: top
objectClass: LDAPsubentry
objectClass: cosSuperDefinition
objectClass: cosPointerDefinition
costemplatedn: cn=AgencyTemplate,ou=agencies,o=company
cosAttribute: passwordPolicySubentry operational
cn: AgcyPwdPol_cosDefinition

Similar Messages

Assign Password Policies to Hosts

I've read in the documentation of DS5.2 that you can assign password policies individually to each user or group; however, I would like to know if the same could be done with different hosts. I have a few hosts that a user must be able to login into even if they fail their first 3 password attempts. On all other hosts I want their accounts to be locked if they fail to login in 3 tries.
Thanks

Are you trying to enforce policies for Solaris/UNIX hosts or other types of hosts authenticating against LDAP ?

Implementing password policie using Role and CoS

Hy all,
I have created a directory with the following partial structure (Sun directory 5.2 patch 2):
ou=people,o=accounts,c=an
|----- cn=user1
|----- cn=user2
|----- cn=user3
ou=services,o=accounts,c=an
|---------cn=user4
|---------cn=user5
|---------cn=user6
I want to assign different password policies based on the ou.
I read within the admin guide that there is a way to do that through CoS and Role: http://docs.sun.com/source/817-7613/useracct.html#wp19625
So I create following records:
- Customized Password Policy Container:
dn: cn=Customized Password Policy, c=an
objectClass: top
objectClass: nsContainer
cn: Customized Password Policy
- External User Customized Password Policy: (same as the global one)
dn: cn=externalUserPwdPolicy, cn=Customized Password Policy, c=an
objectClass: top
objectClass: passwordPolicy
cn: externalUserPwdPolicy
passwordInHistory: 5
passwordWarning: 432000
passwordExpireWithoutWarning: on
passwordRootdnMayBypassModsChecks: on
passwordLockout: on
passwordMaxFailure: 3
passwordMaxAge: 5184000
passwordCheckSyntax: off
passwordResetFailureCount: 1200
passwordMinLength: 8
passwordStorageScheme: SHA
passwordChange: on
passwordMinAge: 86400
passwordMustChange: off
passwordUnlock: off
passwordLockoutDuration: 3600
passwordExp: on
- Service Account Customized Password Policy: (same as the global one except that there is no expiration for password and the password minimum age is set to 2 days instead of one)
dn: cn=serviceAccountPwdPolicy, cn=Customized Password Policy, c=an
objectClass: top
objectClass: passwordPolicy
cn: serviceAccountPwdPolicy
passwordInHistory: 5
passwordWarning: 432000
passwordExpireWithoutWarning: on
passwordRootdnMayBypassModsChecks: on
passwordLockout: on
passwordMaxFailure: 3
passwordMaxAge: 5184000
passwordCheckSyntax: off
passwordResetFailureCount: 1200
passwordMinLength: 8
passwordStorageScheme: SHA
passwordChange: on
passwordMinAge: 172800
passwordMustChange: off
passwordUnlock: off
passwordLockoutDuration: 3600
passwordExp: off
- External User Role:
dn: cn=externalUserRole,c=an
objectclass: top
objectclass: LDAPsubentry
objectclass: nsRoleDefinition
objectclass: nsComplexRoleDefinition
objectclass: nsFilteredRoleDefinition
cn: externalUserRole
nsRoleFilter: (&(entrydn=*o=accounts*)(entrydn=*ou=people*))
Description: Filtered role for external users
- Service Account Role
dn: cn=serviceAccountRole,c=an
objectclass: top
objectclass: LDAPsubentry
objectclass: nsRoleDefinition
objectclass: nsComplexRoleDefinition
objectclass: nsFilteredRoleDefinition
cn: externalUserRole
nsRoleFilter: (&(entrydn=*o=accounts*)(entrydn=*ou=services*))
Description: Filtered role for external services account
- Template Container for Customized Password Policy:
dn: cn=pwdPolTemplateContainer, c=an
objectClass: top
objectClass: nscontainer
- Class of Service (CoS) Definition for password policy:
dn: cn=PwdPol_CoSDefinition, c=an
objectClass: top
objectClass: LDAPsubentry
objectClass: cosSuperDefinition
objectClass: cosClassicDefinition
cn: PwdPol_CoSDefinition
cosAttribute: passwordPolicySubentry operational
cosTemplateDn: cn=pwdPolTemplateContainer, c=an
cosSpecifier: nsRole
- Class of Service (CoS) Template for ExternalUserRole:
dn: cn="cn=externalUserRole, c=an", cn=PwdPolTemplateContainer, c=an
objectClass: top
objectClass: extensibleObject
objectClass: costemplate
objectClass: LDAPsubentry
cosPriority: 2
passwordPolicySubentry: cn=externalUserPwdPolicy, cn=Customized Password Policy, c=an
- Class of Service (CoS) Template for ServiceAccountRole:
dn: cn="cn=serviceAccountRole, c=an", cn=PwdPolTemplateContainer, c=an
objectClass: top
objectClass: extensibleObject
objectClass: costemplate
objectClass: LDAPsubentry
cosPriority: 2
passwordPolicySubentry: cn=serviceAccountPwdPolicy, cn=Customized Password Policy, c=an
- The thing is that it does not to work: if I disable the global password policy, I can set a 3 caracters password even if I specified in the sub password policy that passwordminlengnt is equal to 8 caracters.
Many thanks in advance for your help.
Gregoire

Hmm,
Pretty cool.
I just finished doing it the hard-way when I saw your post :(.
I tried it anyways, and it did all the work that I had done by hand in the previous try. Which was ...
1) Creating the filtered role (same in both approaches).
2) Creating a Container for COS Templates.
3) Creating a COS Template with a dn having a cn string of the full dn to the role in 1) above. Had to use generic entry editor to add all the additional attributes as below ...
dn: cn="cn=TempFilter,ou=people,dc=example,dc=com",
�cn=PolTempl,dc=example,dc=com
objectclass: top
objectclass: extensibleObject
objectclass: LDAPsubentry
objectclass: costemplate
cosPriority: 1
passwordPolicySubentry: cn=TempPolicy,dc=example,dc=com
(started with a new costemplate and the added all the above attributes, also involved things like changing the naming attribute - the dn - from cosPriority to the one cn as shown above)
4) Creatiing a COS with ...
4.1) passwordpolicysubenty as a generated attribute that is overriding and operation (this is picked from the matched CoS template)
4.2) Use the template container's dn from 2) above for the TemplateDN value.
4.3) Use nsrole of the target enty to narrow down to the COS template as in 3) above. I.E. "template"->"attribute name" value is set to "nsRole"
(So when a user's nsrole maps to a cn value of an entry under the TemplateDN subtree. That template applies.)

Custom Password policy for ProxyAgent

Solaris 10 Server Directory Server LDAP 6.3. Clients are Solaris 10.
The clients use "proxyagent" user located in ou=profile. When I create a Global Password policy and apply to my top level dc, then this service account can "expire". I can't have my service accounts expiring...
How do you create a custom filter with NO account lockout, expiration, etc? The DSCC wizard doesn't allow you to as the last step of the wizard must have a bug because even though you don't click the Lockout radio button, the webpage asks you to fill in a number for account lockout of 1 to 32768. Ugggh.
Question 2: how do you apply a custom password policy to ALL of ou=people? I can do it one by one to dn's under the ou=people, but I want it on the parent so new users get the custom password policy. Everything I try, the Global Password Policy wins. (And can't seem to be done via the DSCC but rather through command line)
Help.
Thanks,
Sean

How do you create a custom filter with NO account lockout, expiration, etc?
The DSCC wizard doesn't allow you to as the last step of the wizard must have
a bug because even though you don't click the Lockout radio button, the
webpage asks you to fill in a number for account lockout of 1 to 32768. Ugggh.Logged a new bug
http://sunsolve.sun.com/search/document.do?assetkey=1-1-6787917-1
The clients use "proxyagent" user located in ou=profile. When I create a Global Password
policy and apply to my top level dc, then this service account can "expire". I can't have
my service accounts expiring...Password policies have to be applied to individual accounts (manually or via CoS). So you
may need to create a new password policy and assign it to the proxyagent user. Since DSCC
does not seem to allow you to do that, best to munge it via the commandline (after specifying
the lockout in dscc). Yes, it's ugly but a bug has been logged. Please contact Sun Support if
you want a fix against 6.3 (quote the above bug number)

How i replace default password policy with my custom password policy

Hi All,
can anybody help me to replace idm default password policy with my custom password policy?

1. Go to Security --> Policies
2. New --> String Quality Policy --> define rules --> save
3. New --> Identity System account policy --> define rules and set the policy created in step2 to for password policy --> save
4. Assign the policy created in step 3 to the user
a. when create a user, under the 'Security' tab , for the 'Account policy' select the policy created in step
b. Programattically, create /check out user view, assign the step 3 policy
<set name='user.waveset.assignedLhPolicy'>
<s>step 3 policy</s>
</set>
and checkin the view

Help with Password Policies.

Hi,
I created two diffrent Password Policies, and applied it to xellerate user Resource Object.
Now when i creating a new user of xellerate User type, the password policy doesnt applies, whatever password i gave it takes.
But when i am changing the password, he policies are applied.
Y so??
Thanks
SjiT

Administration->Password Poicies
Policy name_ PolicyTrial_sjit
minimum Length=5
Custom Policy Selected.
Max Length=20
Min Numeric=2
Min UpperCase=2
Resource managemnt-> Rule designer
name = LastName_sjit
Operator= AND(By Default it was selected, please explain what is the diffrence between AND/OR in this)
Type =general
Description-last Name =jain pass rule
Rule Element:
Last name==jain
Resource Object:
xellerate User
(Here Order for organisation is pre-selected. What is the diff bw Order For User and Order fro oragnisation)
Added a Password policy Rule
Rule-LastName_sjit
Policy-PolicyTrial_sjit
ADmin and user COnsole GUide:
logged as xelsysadm
Create User::
PAssword =2
Oraganisation= xellerate User
last Name =jain
User Created :( :(
user Details page..
Clicked Change password.
Password- abc
Confirm- abc
Password Policy Error
Password must contain at least 1 numeric characters.
Password must contain at least 2 alphabetic characters.
Password must not be longer than 10 characters.
Password must be at least 5 characters long.
what wil be the possible cause of such and error.??
Edited by: sjit on Apr 1, 2010 12:17 AM

How to implement extra password policies

What is the best way to configure additional password policies? We are using the
DefaultAuthenticator, and its only password policy is Minimum length. We'd like
to add policies that force a change every 6 months, require a mix of numbers and
alphas, prevent re-use of old passwords, etc.

"Ken" <[email protected]> wrote in message
news:3f900716$[email protected]..
>
What is the best way to configure additional password policies? We areusing the
DefaultAuthenticator, and its only password policy is Minimum length. We'dlike
to add policies that force a change every 6 months, require a mix ofnumbers and
alphas, prevent re-use of old passwords, etc.There are currently no additional password policies that can be configured
for the Default
authenticator. If you need more, then you may have to move to either another
LDAP
server and use the external ldap provider or move to a custom solution and
write your
own atn provider.

Custom Password Policy

Hi xperts,
I want to create a custom password policy which shoud fulfil the following requirements.
1Allow additional alpha characters more other than A-Z and a-z. i.e the ones in Start button--->Programs>Accessories>System Tools>Character Map.
2.Expand the default special characters list
3 and we dont want email prefix(before @ to be used in the password).
Any Ideas if we can do this ?

You can put your validation using Java Script on Create User Form.----this can fulfil my 3rd requirement.
or
you can create custom action class which will validate your password. Change the reference of OLD action class and replace it with yours.
I am a little new to sucg kind of customisations,can u just give me a little idea how exactly I can go about it..i.e which files to modify,which action class etc...
Also I want this password policy for a group of users and if I modify the action class will there be an effect on the policies associated with other resources?

Adding password policies to historical instance.

Hi,
Newbie here - just inherited management of our LDAP systems so please be patient.
We've got a directory instance that has been multiply upgraded. Originally it was based on OpenLDAP then SUN DS5, through DS6 and now DS7.
We have a requirement to add password policies to a subgroup within the repository which I believe I have done but it doesn't seem to work.
So far, taken server from DS5 compat mode to DS6-mode, created password policy via admin interface and applied it to relevant group. Features of the policy are password lifetime, 3 incorrect login attempts, password dictionary etc etc.
Problem: test user tries to log in. After 3 failures there is no lockout. User can fail login any number of times then a correct attempt will work.
The custom policy is set to override the global policy for the affected group.
The question is why is the policy not being followed?
I'm concerned there may be some historical feature of the schema which is preventing the policy from functioning. If this is the case ( and how would I find out if this is so) what might be done about it?
Regards

Hello,
sunPwdPolicy objectclass contains Sun specific extension and derive from the standard password policy objectclass defined in passwordPolicy,
so in general, password policy entries contain both objectclasses as long as you start using Sun extensions
( 1.3.6.1.4.1.42.2.27.9.2.119
NAME 'sunPwdPolicy'
DESC 'Sun Directory Server Password Policy objectclass'
SUP pwdPolicy
AUXILIARY
MUST ( cn )
MAY ( description $
passwordRootdnMayBypassModsChecks $
passwordStorageScheme $
passwordExpireWithoutWarning $
pwdIsLockoutPrioritized $
pwdKeepLastAuthTime )
X-DS-USE 'internal'
X-ORIGIN 'Sun Directory Server' )
( 1.3.6.1.4.1.42.2.27.8.2.1
NAME 'pwdPolicy'
DESC 'Password Policy objectclass'
SUP top
AUXILIARY
MUST ( pwdAttribute )
MAY ( pwdMinAge $
pwdMaxAge $
pwdInHistory $
pwdCheckQuality $
pwdMinLength $
pwdExpireWarning $
pwdGraceAuthNLimit $
pwdLockout $
pwdLockoutDuration $
pwdMaxFailure $
pwdFailureCountInterval $
pwdMustChange $
pwdAllowUserChange $
pwdSafeModify)
X-DS-USE 'internal'
X-ORIGIN 'Password Policy for LDAP Directories Internet Draft' )
-Sylvain

OIM Password Policies

Hello All
I have a number of users setup in OIM and am using it for provisioning. I have the users in different organizations based on class of user and permissions to the portal. I have a need to have different password policies based on the organizations of the users. I looked through and it doesn't look like you can assign a password policy to an organization. Do you know of a way to assign users in org1 password policy A and others different policies? I looking at the xellerate users resource object and thought maybe I could do a rule to look for org1 but not sure if this is possible. Any help you can give would be appreciated.
Thanks
Nick

in terms of using an entity adapter, how would you go about doing that? Would it be based on user insertion or update? also, when trying to add a password policy, it asks for a rule then the policy, is there a way to develop a rule to use when assigning the password policy?
Nick

Applying different password policies to different groups (contexts)

How do you assign different password policies to different groups (or contexts) in the OID?

According to chapter 18 in the Oracle Internet Directory Administrator's Guide Release 9.0.2 Part Number A95192-01, it doesn't look like you can apply password policies on the group level. At any rate, they only seem to talk about password policies being assigned at the subscriber level.

Introducing a custom Password policy to expire passwords. odsee 11g - what are the expected results

We have left the default Password Policy untouched. As a default password aging is off. Our DS compatibility mode is now DS6 so we can add Password Policies with max age!
Some users need to have their passwords changed regularly due to political reasons.
We have introduced a custom Password Policy which has a pwd_Max_age value of 180 days and allows the user to Change Password. Entry is cn=Custom Pwd Policy for ABC,dc=mycorp,dc=com
Ok. Now we get confused by the behaviour of this ODSEE 11g server. Now, we are ADDING a new custom Password Policy to just a few selected users!
1. When we add the Policy to the user by setting the passwordpolicysubentry attribute = "cn=Custom Pwd Policy for ABC,dc=mycorp,dc=com"
- Nothing seems to happen.
- WHEN IS THE PASSWORD EXPIRED?
2. After we change a password for a user who has the passwordpolicysubentry attribute, he gains a new attribute pwdChangedTime
- IS THIS THE ONLY TIME THE EXPIRY CLOCK STARTS TICKING? *AFTER* THE PASSWORD IS CHANGED?
3. Is it true, that if a user never changes his password, even if he gets the new custom password policy applied, his password never automatically expires????
I just cannot work out what is supposed to happen. I would have hoped that at the very least, the password begins to expires as soon as he gets a Password Policy with pwd_Max_age set.
How is ODSEE 11g designed/supposed to function.
Help!!!!!
*HH

Sylvain ,Many thanks for your reply and suggestions. Always good to have a choice!
So it seems the only way to get the password aging clock to tick is for the password to be changed after having the password policy applied.
Option1 is not really an option although it certainly would make the users change the password and set up the password aging...
The main difficulty with odsee 11g (Version 11.1.1.7.0) is that pwdChangedTime is a system read-only attribute linked to a modification to userPassword attribute, I cannot use ldapmodify to add/modify the pwdChangedTime attribute.
I was amazed that I can read/store the userpassword as the base64 string and replace the userpassword attribute with this value using ldapmodify. This is very easy (and works!) but will cause the pwdChangedTime attribute to contain the same time for all users. I can imagine helpdesk loving it when everyone calls them in 6 months time.
Using the LDIF backup/restore utility looks the best option, if it succeeds. At least we can randomize the actual value of pwdChangedTime with this approach.
Mercy Buckets.

Can you assign multiple customer masters to one Business Partner in R/3?

We are trying to configure SAP Business Partners in ECC5.0 but it seems the relationship between a business partner and a customer master is one-to-one so a business partenr cannot have multiple customers (table BD001 only allows for a single entry). Does anyone know if it's possible to assign multiple customer masters to one business partner? If so, is there any documentation available?
Many thanks.

We are trying to configure SAP Business Partners in ECC5.0 but it seems the relationship between a business partner and a customer master is one-to-one so a business partenr cannot have multiple customers (table BD001 only allows for a single entry). Does anyone know if it's possible to assign multiple customer masters to one business partner? If so, is there any documentation available?
Many thanks.

Can i assign one customer to more than one company code how?

can i assign one customer to more than one company code how?

Hi
First Create the Customer Centrally in XD01 and then extend the same Customer in FD01 for the required company codes.
Regards
Venkat

*** How to get the username in a custom password change routine....

How to get the username in a custom password change routine / procedure / form when a user's password has expired and is redirected automatically to this custom program?
We use the 2nd parameter in LOGIN_URL column in WWSSO_LS_CONFIGURATION_INFO$ table to get to this custom change-password proc.

OK !
Use that maybe good :
select USERID into v_user from sys.aud$
where ntimestamp#=(
select max(ntimestamp#)
from sys.aud$ );

Assignment of custom password policies

Similar Messages

Maybe you are looking for