Password policy operational attributes

Edit online

The listed operational attributes are provided by the password policy feature.

Attribute name Syntax Description
pwdChangedTime GeneralizedTime Contains the time the password was last changed or the password policy start time whichever is recent.
pwdAccountLockedTime GeneralizedTime Contains the time at which the account was locked. If the account isn't locked, this attribute isn't present.
pwdExpirationWarned GeneralizedTime Contains the time when the password expiration warning was first sent to the client.
pwdFailureTime GeneralizedTime A multi-valued attribute containing the times of previous consecutive login failures. If the last login was successful, this attribute isn't present.

When a user account is set to no lockout, for example, by setting pwdLockout=false or pwdMaxFailure=0 or cn=noPwdPolicy, then the existing content of pwdFailureTime are removed and only the latest timestamp is recorded when an invalid bind is attempted.
pwdGraceUseTime GeneralizedTime A multi-valued attribute containing the times of the previous grace logins allowed after the password expiry. The pwdGraceLoginLimit attribute is set on the server to limit the number of grace logins allowed by the user with an expired password. The contents of this attribute is cleared only after the password is changed to a valid password value; otherwise, the attribute value continues to increase until the pwdGraceLoginLimit is reached.
pwdHistory Directory String Stores the history of previously used passwords. The password portion of this attribute is stored by using the same encryption method as the userPassword is stored in. The passwords stored in this attribute are compared to the new userPassword that the user has entered.
pwdReset Boolean Contains the value TRUE if the password was reset and must be changed by the user. The value is FALSE or not present otherwise.
ibm-pwdAccountLocked Boolean Indicates that the account has been administratively locked.
ibm-pwdIndividualPolicyDn GeneralizedTime DN of a password policy entry that can be associated with a user entry.
ibm-pwdGroupPolicyDn GeneralizedTime DN of a password policy entry that can be associated with a group entry.