How to retrieve a password policy response after a ldap bind operation

Background:
I've set up openldap with the ppolicy overlay. The overlay works as expected, but after a bind operation I need to get hands on the ppolicy response.
This can be done manually (with shell commands like ldapsearch) by specifying '-e ppolicy' (general extension).
But how can i get hands on response from my LoginModule? Code:
env.put(Context.SECURITY_PRINCIPAL, userDN);
env.put(Context.SECURITY_CREDENTIALS, inputPassword);
ctx = new InitialLdapContext(env, null);
..is it possible to use ExtendedRequest or UnsolicitedNotificationEvent when the creation of the context throws a NamingException (the bind operation fails due to a locked account).
Thanks in advance!
J�rgen L�kke

Hi,
I am having the exact same problem in that OpenLDAP is implementing the password policy people login and everything is fine, but then the password expires and bang they are out. I would like to be able to give my users some warning to say that their password will expire in x days or that your password has expired you have X logins left.
Anyway I have tried the methods suggested here and using ctx.getResponseControls() will either give me null or an array with the exact same objects that I passed in with new InitialLdapContext. What I have did work fine when we used the old jar libraries but we moved to JNDI.
Any help would be appriciated

Similar Messages

How to retrieve the Authentication Policy Responses?

In my OAM server(OAM 11.1.1.5), I configured a Response in authentication policy to retrieve the user information after user signed in, the response item named "UserID", value is "$user.userid", type is "Cookie".
My question is:
If I use the WebGate , I will got the response items after user signed in. But I need to develop an Access Gate use the ASDK to replace the WebGate, I don't know how to retrieve the Response items by the ASDK.
Below is the access log captured by Fiddler, "http://auth.mydomain.com/login.aspx" is my customized login page.
-----------------------------Web Gate 10g (IIS)----------------------------
GET http://alan-hu.mydomain.com/oamtest/index.aspx HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://auth.mydomain.com/login.aspx?authn_try_count=0&request_id=6476845472436935518&OAM_REQ=VERSION_4%7EFC5cvGlDZbKLQVbcnbvJSmtBw163LKRGyryAQ8b3CvEpVzVXpqqVE3Nbdcf3K7J957wIyP1d%252bEHNaC92smcnXnYxZr7xSfW8eNMU9NlFRnCUoNBTNXR6jZr8Ug8zqnSau5U%252bEnlInxHudS%252bTzD%252bUy5E9qUfX6lySlHfesJbBBH2yubEJ%252fJVrjbetqv5L295D1mhF%252f7VKyTED%252fAOv2LaVjT7Mi9PGkKDwGkZy9Th5vKVCvT58V%252fEYEgWqawE2LUv%252fb9nh7mdP5gRGBcoDpIeqXWo1F9G767%252feG9vPxM7jZRlGWcMKuYQYSn1oTg%252fL1KBE0KW2EJPvOiBpsplU7e0BvbqWgoSR8ctora%252fj2DHbHZh7m2k1GulUeBRiF3MKbY8XulBEtOYIuc02qVNhlQg2XAHOOk%252bqQ1Z6oua3DWH0aru6jnlFNpsTx6Rk2Q4WHAhXqKPzTwjtVHLgs%252b7Fb32D2Ncz%252fQqx%252b%252bfRtK9yS4YSNcoA3AmF15HoHgFd0lXQzUuQzxsDiho5S6GRc5QY2UvTz%252fsoC0Osismkd%252bUx0yZtxeFJrqA1%252f%252b9eeN%252fEFLMes2%252bxn7jxDP9ahl%252bDKaF9GdypVNZAKSdxSdUKcVCWHneHRRRtqdW8jcUEcTzohuCdCOvEgETz%252fksM7nsFHq01GHakc8174sXvcEE1l1jvsPy8f1CBf75DtguanLVIfenmUEp7kcRhe1vIgiBxmNefuhMKhLV%252fW%252fveJgnuMtWZ%252bgc2Yr%252bYFL5Qe9yz3Zz0Zn2d4PAzZWiS9teBrLqzAk6dU5dM9JTGdthstrhwjovP96J252mAGrRjo%252fFWTByyfrXYoQzETxV8QCDl8kDWaCsZl6V3Ahm94gDcTQrW8MYK8PJDlkUlnVtRtaDevrv4%252fQY%252bFvo78W1iKYM9v9O%252fu0EgPqyOJBg%252fYsBC5fI4VV7OvLZ1YoPb2v6IsepN9avD8nTB6B%252f5ZW0z1IxocptShWgjb5fMrDclA%252fEqgShz0QXzkoOa80cqLu%252bNEG7aUHQQXhZEG42zCN0NaJZbENpksK5ZyKo8U92KdjdSgHeUsFbWA0jZ%252b5nIIYHtesLFwoRZw%252f%252bbceyXAG8%252b6LMjJWYsRpl8bKKJejnOIvzM1dlY7PQ%252bf8eCtGxPkCaCa%252bkuJUkhHcK%252bsS5T2JMyocrBj0hIZsBXiWIrtmGr5h%252bbQIT8TdTfVCmUiv3zBRgDSvQqpJ3hAFc0NIk6zJS%252bPxSquhuYIH15G7zeN%252faW3sRecDpH8%252bFqa7HsT7xDukI2c6Ro3x7Bvp5MBEBSITibP41PJo7f5kPP6wFIk3rMpsC9r7zsSU0pzN3RvWn5M5gNyQ4EZVuwYMFCfgIAjRKRcNUWHebwSMxsOhwrsYESNfA9rFYxtOapzvIcx63B%252baR%252bsQXHI%252fQ4eoP2VBkkCOktummpQ41bDC6elI5LhFrAlSwCT5qv4ytCSBRan6OfMZ%252bLSA5J%252fkFtTvx2aNbV&locale=en_US
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Cookie: ObSSOCookie=NQqPNA%2BvLoyIujMLO%2F3VWalLMpFbnK6IW4uvEl1piC8hoQVQw%2FqGbDdkVg%2BDDcx1O7YeJhFVYinyJtKF8vI3VTQ%2BL3StaWFRZFLl7KqHnQEqdNVgkn4FCfx49t2KzXNQ%2FxLBkF0olHoNU1P01VTMOdQsq4hzdc6C0B7X6PM9hoaVGWvVmsbUKr5BmqWBG0aHbT1HXgNKlVsDimyz2Q9iy%2Briiu8%2B7x190rm8PTm3uXqEUqs4zuvOSdjZGs77uUFzeYnEzQb6T9gcZqyUvo8OtXqnmrUtPwdva8UrV9GlUkymsWDDtNk3iIqapLxQL1oXHO0iH2KXzXfUAcnQca%2BfNw%3D%3D
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Pragma: no-cache
Host: alan-hu.mydomain.com
HTTP/1.1 200 OK
Cache-Control: no-cache,private
Pragma: no-cache
Content-Length: 649
Content-Type: text/html; charset=utf-8
Set-Cookie: UserID=TEST; path=/
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 05 Jul 2012 08:14:13 GMT
-----------------------------My Access Gate (IIS)----------------------------
GET http://alan-hu.mydomain.com/oamtest/index.aspx HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://auth.mydomain.com/login.aspx?authn_try_count=0&request_id=-8854367975480028914&OAM_REQ=VERSION_4%7EslyJg6j%252fLhjd%252b%252b%252fAFDpFiRr4cPvaT3dU90HILcJWiqxptP4dV%252fNkm4eAzVOznnJmtFh8SNMg4G5K2IuCABhCNxJuFau4XUgfRJtQl03anU6YgU1U%252fc3nRevxNFTZ8bIGALMXNiGbtnNO7c9WRUy%252bekw7T5YidA2qr103PNQD0g36jKosUb2aT2kOYJ0HoZizyW%252bCeI2ARhjuqB4Kc0Kfv%252fHuZCCwcUychXY5cGDlcD2UVl9YRwEGBdcYnweNbps18LqmQNm0%252fJYh2XwW80hNKqRBQBGPUCrYP8A0XIF2%252bUFvViDfqcuK05n0vv5NErxih%252bgtZKRObD6pHsnLOd2a19jUU%252fsFaFYQ0n5UdTN0JSx8yFtvEjdwXKya2PGqKqHa2JzEXhLBXTP5eC4EavAwAMbVRVtNTle%252fU29tDOuUtb1NLTBsqI63ipchzUvouQ6QREcybIXErAMX06X9gpwEtMBXYCppIiV%252b67XpETVzcmMuOl%252bSj9Aha6AKy3yPYlEOTA0o5HqOMe2NTu2sSvJxUJJW0ZYXvqkprkWsaw5SBACH473KY7WS0kqUIiV7UoN60cRdT9I3fAdyuLzWDS7dhGKKTstmpTxClQQNlw7XcDfdczqJJBRSwbZQyomnSPRcO%252f%252f5EY56wSXMJLv5WDkfb3RC4Va5rzXeQn1McihExvrymn6ztZ2A6zZso%252b0jDObEa%252bWioCBinvdK%252bF85qk8ai%252bLal30b27oNzFHKc1AELQ7eP%252bkoyXDYQpVeHfX9ujHGAcEdN4FTGyxBoIohbQb%252fEvl3uEga%252fsufBa%252fVcFVM8WTI59kUSOCKankogv9ABry7CxYByZURjjloQp1CZif%252fuN1ddg5yGMuqmvY7OFz8BIT8mm%252b0klysXJbcneztKbVm2njffvj29gardyyFZ1%252fXDPqMJM1OKVcughERRZW%252fHbBFZ5h%252fupGqhgXaNXZGoeg%252bm8iaAXqrxRIg7NHmK7VnEtIV2qo4iDYWl%252fmf09eJJHMrhhQNRLjV5drgiIwGuPZWVC4irUhXBOPixks8StHx0c0TV%252boIRPxiyupLJKzdlE0SBjplC1%252ffMjiVgQGqZ2zena7601QT89vmuU%252bkO1NoAnN8iwZNF1dT45RDbfg8TLcK1C0CGb29eN7dbwBtbgnAAOXX8F421RTSv9W6UAn%252bttP%252fr2teYO8eXOwFkGMrGkdxdt%252b7%252fj9oH1nJ92Mviv5fiuxhnx9ukvyjQdkdGl0gnGVehnDIQODIXEG0EmEo9%252fJtQkNjgwLlKvTK5bcqIg0Kez27GqEKYhNc4XRsuYsfPQ2byH%252bnnsSDz%252bOLo43ub8vZ7XNWjMtQrNUpfbOwmw5jhfPsU9E2xgYTHGvDdbKBrLXgxQrO%252fSflCzRPhpc5gE9zOOFkCskHxy%252b%252bI8zyJFT7lEaIhz6WgXa5nk3An%252b9yukw2YkoFe1WB%252bfZsgdr%252fq%252b%252blUqjfUf1G5lHDUjODh0qh&locale=en_US
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Cookie: ObSSOCookie=fhyRb/mqqsz1Tk7Ma3aAvuTmisrarOveqR1FWPkCOKcMG860oQ/V/trZzor0ZPZs4lOl3yHvf83Jj1ahsffCMIueaSlJqHoBZPFB+uLlof9KV6OzyztVzLaxUql/qddGnzajvRs0ti9vKx84AsnMEbZwTcYdf8CNesOh5aSSgz4r6U2D3/rWaT/s1h7vda9rUhD7McjybboHWThM1sKVUGmDFJBA3XdXpwCbG+L35yw5NdablTgB8KOCaAiYDSNsbRkDRluzAxrwD9r/glEq9xI7X3fQ+t40PEQ/sIVFAy+BH6fqXUUEN6D8sc3GKt5RxxTzNzaHLoczlLyakAainQ==
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Pragma: no-cache
Host: alan-hu.mydomain.com
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 05 Jul 2012 08:29:41 GMT
Content-Length: 649

Summary:
1. The Responses of Authentication Policy will be retrieved after user just signed in:
ObConfigMgd.initialize();
ObResourceRequestMgd rrq = new ObResourceRequestMgd("http", "//alan-hu.achievo.com/oamtest/index.aspx", "GET");
ObDictionary creds = new ObDictionary();
creds.Add("userid", "test");
creds.Add("password", "Tt1234");
ObUserSessionMgd session = new ObUserSessionMgd(rrq, creds);
ObDictionary actions = session.getActions("cookie");
ObConfigMgd.shutdown();
2. The Responses of Authorization Policy will be retrieved after execute the ObUserSession.IsAuthorized() method:
ObConfigMgd.initialize();
ObResourceRequestMgd rrq = new ObResourceRequestMgd("http", "//alan-hu.achievo.com/oamtest/index.aspx", "GET");
HttpCookie ObSSOCookie = Request.Cookies["ObSSOCookie"];
string sessionToken = ObSSOCookie.Value;
ObUserSessionMgd session = new ObUserSessionMgd(sessionToken);
if (session.Status.IsLoggedIn && session.IsAuthorized(resource))
ObDictionary actions = session.getActions("cookie");
ObConfigMgd.shutdown();
-----

How to retrieve schema password?

Hi,
i forgot my important schema password. how to retrieve schema password?
Thanks,

You cannot retrieve your password but you can reset it.
Connect as SYS/SYSTEM users and reset the password for the required user.
ALTER USER username IDENTIFIED BY newpassword;

How to search for password policy

Hello,
Using DS 5.2:
I've created a test policy, dn: cn=Test Policy,ou=People, o=xxx, o=isp. I can apply the policy, I can see the policy in my backup ldifs, but I can't figure out how to search for and display it (and eventually, delete it) either from the command line using ldapsearch or form within the admin gui. Any help?

What I would like to do is query my 8i instance for the current password policy
Can anyone provide a query to retrieve this info?connect as sys
in Oracle 8i and issue the command;
select object_name,object_type from all_objects where object_name like '%PASS%';
and
select object_name,object_type from all_objects where object_name like '%POLICY%';
I think , i'm not sure these policies would be transfered to 10g through migration except -if any- some of them are obsolete to 10g!!!!!
Regards,
Simon

How to retrieve forgotten password?

I have an ipod touch 4th generation and have forgotten the password.
It was disabled after trying more than six times to access correct code.
Now it is unlocked after I have connected it to itunes...but is still asking me for password and I have entered 3 wrong ones so far.
What can I do to retrieve the password?

Disabled
Place the iOS device in Recovery Mode and then connect to your computer and restore via iTunes. The iPod will be erased.
iOS: Wrong passcode results in red disabled screen
If recovery mode does not work try DFU mode.
How to put iPod touch / iPhone into DFU mode « Karthik's scribblings
For how to restore:
iTunes: Restoring iOS software
To restore from backup see:
iOS: Back up and restore your iOS device with iCloud or iTunes
If you restore from iCloud backup the apps will be automatically downloaded. If you restore from iTunes backup the apps and music have to be in the iTunes library since synced media like apps and music are not included in the backup of the iOS device that iTunes makes.
You can redownload most iTunes purchases by:
Downloading past purchases from the App Store, iBookstore, and iTunes Store
If problem what happens or does not happen and when in the instructions? When you successfully get the iPod in recovery mode and connect to computer iTunes should say it found an iPod in recovery mode.

How to ignore the password policy in a custom workflow?

Hi,
We have a custom workflow which is called via SPML to provide 'Administrator Change Password' functionality in a portal.
Our password policy sets the String Quality rules and Number of Previous Passwords that Cannot be Reused. But we like to bypass the password policy when the password administrators (who have a admin role with a capability - 'Change Password Administrator'). At least, restriction ' Number of Previous Passwords that Cannot be Reused' need to be ignored (But password need to be added to the history... cannot disable adding passwords to history).
Please advice me how it could be achieved?
The workflow steps:
1. Checkout 'ChangeUserPassword' view for the user as an administrator
2. Set the new password in the view, set true to view.savePasswordHistory
3. Set password on the resources
4.Checkin the view
Thanks
Siva

Thanks eTech.
My main goal is to skip the password history check (new password can't be a last used 10 passwords) when admin change password workflow is launched. As you suggested , I created a special password policy exactly as our regular password policy excluding "Number of Previous Passwords that Cannot be Reused" setting.
Then before change the password of a user as admin, special policy is attached , password changed, and user's password policy is reverted back to regular one. The issue is, as the special policy does not enforce the password history check, the whole password history of the user is wiped out from the user object when the password is changed by admin change password workflow. We don't want this to happen.
Please guide me whether is anyway to achieve just ignoring the password history without any other impact on user.
Is adding passwords to user object's password history list is triggered by "Number of Previous Passwords that Cannot be Reused" setting of the password policy??
Thanks
Siva

How to implement forgot password policy in OIM

Hi,
I want to implement forgot password Policy on OIM 11g r1.
Can any one please help me on this.
I mean from where to start and how is the follows goes..
Thanks in Advance :-)

Forgot Password functionality is OOTB.
You can configure Forgot Password Question Answers. Go to System Configuration (Advance Console) and search for different properties associated with Challenge Questions Answers.
OIM.DisableChallengeQuestions
PCQ.NO_OF_CORRECT_ANSWERS
XL.IsDupResponseAllowed
etc..
You can also add new Challenge Questions as well by adding into Lookup.WebClient.Questions

How to list current password policy

Hello all,
This is my first post here. I just finished the DBA Workshop 1 course and my company is migrating from 8i to 10g.
Our primary DBA is on vacation and before he left asked me to look at the new 10g install he did in our test environment. I noticed on the OEM there were some policy violations and I'm using MetaLink and hopefully this forum to resolve them.
What I would like to do is query my 8i instance for the current password policy and apply those to our test 10g instance. Can anyone provide a query to retrieve this info?
Thanks,
Bill

What I would like to do is query my 8i instance for the current password policy
Can anyone provide a query to retrieve this info?connect as sys
in Oracle 8i and issue the command;
select object_name,object_type from all_objects where object_name like '%PASS%';
and
select object_name,object_type from all_objects where object_name like '%POLICY%';
I think , i'm not sure these policies would be transfered to 10g through migration except -if any- some of them are obsolete to 10g!!!!!
Regards,
Simon

Password policy, gone after remote wipe or firmware upgrade?

I am investigating if the iPhone is a serious option for our customers. I learned a lot the past days, but I still have one important questions.
I have an iPhone with a password policy
Situation 1:
I perform a remote wipe, the latest firmware installs itself after the activation and I don't put back a backup.
Situation 2:
I update the firmware of my iPhone with a 'restore' and don't put back a backup.
Question:
For both situations: Is my password policy still on the iphone?

I assume you intend to set the password policy via a configuration profile. The policy will remain in place until the device is wiped. After that it is basically a fresh phone, and neither any data nor any profiles will remain on the phone.
Your goal is probably that any sensitive information is only stored on a phone with a password policy enabled. For this you would essentially have to put all that information on a VPN, and provide the key / certificate to access that network with the profile, so that a user would not be able to gain access to the information without the profile.

How to create a password policy for password syntax?

Hi,
I need to apply a password policy in OID that checks the password syntax. We need to verify that the each password contains at least three of the four character groups (Capital Letters / Small Letters / Numbers / Special Characters). In OID, I may only check for minimum Length and a min Number of Numbers. Is there an easy way to do this? (Plugin in OID?)
For the Web-Part (eg. Portal) its quite easy, as we may create a Javascript to check the syntax on the "change password" page, but as we have diffrent types of access, we want to get the rule applied in one place.
Thanks for help
Alex

Hi,
In addition to Martin’s suggestions, we can also choose to change the scope of the existing GPO with Security Filtering.
Regarding Security Filtering, the following article can be referred to for more information.
Security filtering using GPMC
http://technet.microsoft.com/en-us/library/cc781988(v=WS.10).aspx
Filter Using Security Groups
http://technet.microsoft.com/en-us/library/cc752992.aspx
Best regards,
Frank Shen

How to create new password policy in FIM

Can anyone assist me is there any way to create a new password policy in fim similar to creating password policy in OIM.Any related inforamtion is useful and appreciated.

Ref to below Link it might give you some idea:
http://www.iamblogg.com/password-policy-violation-exporting-to-ad-from-fim-2010/
Regards~
Deepak Arora
If you Find the Answer | Article | Blog Helpful Please Vote As Helpful / Mark As Answer

How to add new password policy to cn=config via LDIF file

I am trying to add a new password policy called "Service Password Policy". I have the following LDIF file:
dn: cn=Sservice Password Policy,cn=config
changetype: add
objectClass: top
objectClass: passwordPolicy
cn: Service Password Policy
description: A password policy intended for proxy or service accounts.
passwordMustChange: off
passwordChange: off
passwordMinAge: 0
passwordInHistory: 0
passwordExp: off
passwordMaxAge: 2142720000
passwordWarning: 0
passwordExpireWithoutWarning: off
passwordCheckSyntax: off
passwordMinLength: 6
passwordRootdnMayBypassModsChecks: off
passwordStorageScheme: ssha
passwordLockout: off
passwordMaxFailure: 32700
passwordUnlock: on
I've tried various permutations of this command:
dsconf import -h localhost -p 1389 /root/createServicePasswordPolicy.ldif "cn=Service Password Policy,cn=config"
I get this error:
"cn=config": suffix does not exist.
The "import" operation failed on "localhost:1389".
Thx for any help,
CC

Good it did not work or you would have overwritten all the data currently in cn=config. Anyway, "dsconf import" only works on regular backends. The cn=config tree is special a.
You should use ldapmodify to add the contents to cn=config.
$ ldapmodify -p 1389 -D cn=root -f a.ldif -a

How to retrieve the password of user in BOE thru SDK?

Dear all
In Java Code:
Can we use the administrator to login the BOE, and retrieve the password of specific user in BOE thru SDK?
Thanks and best regards.
David Zhang

Hi Ted
Thanks for your sharing.
David

How can I deploy password policy to a specific group?

Dear All,
I would like to deploy password policy to specific OU for testing purpose. As I know password policy only can setup in
Default Domain Policy or new created policy and save at the root of domain. Is there any method for me to test the password policy for specific OU? Thanks.
Frankie

Hi,
As Vivian said, Fine grained password policy cannot be applied directly to an OU.
Instead you can create a global security group in the OU and apply the fine grained password policy.
For example, if you need to apply a password policy for "Sales" OU, you can create a global security named "Sales Users" and assign the Fine grained password policy to this group. Then you can add the users to be tested in the "Sales"
OU as members of this group.
Checkout the below link on the deployment scenario of Fine grained password policy,
http://blogs.technet.com/b/askpfeplat/archive/2013/10/07/fine-grain-password-policy-for-active-directory-2008-domain-does-not-apply.aspx
FYI - To activate the fine grained password policies, you need to raise your domain functional level to Windows Server 2008 or higher.
Regards,
Gopi
www.jijitechnologies.com

How i replace default password policy with my custom password policy

Hi All,
can anybody help me to replace idm default password policy with my custom password policy?

1. Go to Security --> Policies
2. New --> String Quality Policy --> define rules --> save
3. New --> Identity System account policy --> define rules and set the policy created in step2 to for password policy --> save
4. Assign the policy created in step 3 to the user
a. when create a user, under the 'Security' tab , for the 'Account policy' select the policy created in step
b. Programattically, create /check out user view, assign the step 3 policy
<set name='user.waveset.assignedLhPolicy'>
<s>step 3 policy</s>
</set>
and checkin the view

How to retrieve a password policy response after a ldap bind operation

Similar Messages

Maybe you are looking for