Subject: Re: comments on ldap password policy draft

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 25 Oct 1999 14:36:25 -0700

At 10:46 AM 10/25/99 -0600, Jim Sermersheim wrote:
>>If you want to avoid the policy fetch for each bind, you
>>could store both a timestamp of last password modification
>>and the expiration time.
>
>I'm not sure how that would help. Wouldn't we still need to look at the policy (in case it changed?)

No.  pwdExpirationTime would be computed on every policy change
based upon pwdPasswordTimeStamp.  The advantage of having
pwdPasswordTimeStamp is that you have a reference time to
use in computing pwdExpirationTime.

If pwdPasswordTimeStamp didn't exist for some reason when the
policy was changed, then you would have to fall back to either:
	1) expire now
	2) expire policy seconds from now.

The choice, of course, could be a matter of policy.

----
Kurt D. Zeilenga		<[email-masked]>
Net Boolean Incorporated	<http://www.boolean.net/>

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 25 Oct 1999 15:23:08 -0700

pwdExpirationTime and other per password value attributes only
assume the password attribute can only contain a SINGLE-VALUE.
userPassword, however, is defined to allow multiple values.  I
am unsure of single-valueness of alternatives to userPassword.

Regards, Kurt

----