How to determine users whose password has expired?

Question

Hi.
Is there a programatic method of determing which users have expired passwords and/or have been locked out?
Thanks.
Ian

Answer 1

Ian,
you need to check pwdaccountlocktime for locked users.
following a pl/sql code snippet that should give you a hint how to do that pwd expiration.
regards,
--Olaf
-- returns users expected expiration date
-- using pwdchangedtime (users) + pwdmaxage (from password policy)
FUNCTION get_pwd_expiration_date(p_userid IN VARCHAR2)
RETURN VARCHAR2
IS
l_expiration_date VARCHAR2(10);
l_user_dn VARCHAR2(256);
BEGIN
SELECT 'cn='||p_userid||MAX(DECODE(gf_name,'LDAP_BASE',
decode(substr(gf_value,1,1),',',gf_value,','||gf_value),null))
INTO l_user_dn
FROM gr_application_parameters;
l_expiration_date := to_char(to_date(substr(get_attribute(p_userid,
'pwdchangedtime'),1,14),'RRRRMMDDHH24MISS')+get_pwdmaxage_days,'MM/DD/RRRR');
RETURN l_expiration_date;
END;
-- returns pwdmaxage in days from ldap
FUNCTION get_pwdmaxage_days
RETURN NUMBER
IS
l_pwdmaxage_days NUMBER;
ldapbase VARCHAR2(256);
l_dn VARCHAR2(256);
retval PLS_INTEGER;
BEGIN
SELECT MAX(DECODE(gf_name,'LDAP_BASE',decode(substr(gf_value,1,1),',',
gf_value,','||gf_value),null))
INTO ldapbase
FROM gr_application_parameters;
l_dn := substr(ldapbase,instr(ldapbase,',',2));
l_pwdmaxage_days := to_number(get_attribute(my_global_session,
'cn=PwdPolicyEntry,cn=Common,cn=Products,cn=OracleContext'||l_dn,'pwdmaxage'))/24/60/60;
BEGIN
retval := DBMS_LDAP.unbind_s(my_global_session);
EXCEPTION when others THEN
null;
END;
RETURN l_pwdmaxage_days;
END;
FUNCTION get_attribute(p_session IN DBMS_LDAP.session,
search_base IN VARCHAR2,
p_attr IN VARCHAR2)
RETURN VARCHAR2
IS
my_session DBMS_LDAP.SESSION;
my_message DBMS_LDAP.message;
my_entry DBMS_LDAP.MESSAGE;
attrs DBMS_LDAP.STRING_COLLECTION;
my_retvals DBMS_LDAP.STRING_COLLECTION;
action NUMBER;
retval PLS_INTEGER;
entry_index PLS_INTEGER;
attr_value varchar2(2048);
BEGIN
IF p_session is null THEN
ldap_utl.get_ldap_session(my_session);
ELSE
my_session := p_session;
END IF;
attrs(1) := p_attr;
retval := DBMS_LDAP.search_s(my_session,
search_base,
DBMS_LDAP.SCOPE_SUBTREE,
'objectclass=*',
attrs,
0,
my_message);
my_entry := DBMS_LDAP.first_entry(my_session, my_message);
entry_index := 1;
--print('Got my_entry. Check to see if its null now');
WHILE my_entry IS NOT NULL
LOOP
--print('my_entry is not null');
my_retvals := DBMS_LDAP.get_values (my_session, my_entry, p_attr);
IF (my_retvals.COUNT = 1) THEN
attr_value := nvl(my_retvals(my_retvals.FIRST),'NO_ROWS_FOUND');
--print('Retrieved Value: '||p_attr||' = '||attr_value );
END IF;
IF (my_retvals.COUNT = 0) THEN
attr_value := 'NO_DATA_FOUND';
--print('Retrieved Value: '||p_attr||' = '||attr_value );
END IF;
IF (my_retvals.COUNT > 1) THEN
attr_value := 'TOO_MANY_ROWS';
--print('Retrieved Value: '||p_attr||' = '||attr_value );
END IF;
my_entry := DBMS_LDAP.next_entry(my_session, my_entry);
entry_index := entry_index+1;
END LOOP;
--print('YOu should have at lease one entry of "my_entry is not null"');
RETURN attr_value;
END get_attribute;