Subject: [ldapext] pwdInHistory vs pwdHistoryDuration

From: Kurt Zeilenga <[email-masked]>
Date: Fri, 2 Jul 2010 13:08:13 -0700

As previously noted, I believe it better to keep expire history based upon time in history not number of history.  The latter leads to the need for pwdMinAge, which from a security perspective, is a really bad idea.

At Isode, we ignore pwdInHistory and instead utilize an additional attribute, pwdHistoryDuration, to control history expiration.

-- Kurt