Password policy queries

You can issue the commands provided here to resolve password policy queries.

The password policy operational attributes can be used to view the status of a directory entry or to query for entries matching specified criteria.Operational attributes are returned on a search request only when specifically requested by the client. To use these attributes in search operations, you must have permission to critical attributes, or permission to the specific attributes used.

To view all password policy attributes for a given entry:

ldapsearch -s base -D <adminDN> -w <adminPW> -b "uid=user1,cn=users,o=sample" 
"objectclass=*" +ibmpwdpolicy

The pwdChangedTime attribute is updated only when one of the following conditions is met:

pwdMaxAge and pwdMinAge has non-zero values.
You do not have prior explicit value for pwdChangedTime (which is not the same as ibm-pwdPolicyStartTime) .

The pwdChangedTime attribute value can be used to determine password expiration time. The expiration time is calculated based on the password policy start time and the creation timestamp of user entry. If one of the dependent values do not exist, the pwdChangedTime attribute might not exist. Therefore, the pwdChangedTime attribute in a search filter might not return all the user entries for which the passwords are about to expire. To determine if a user password is about to expire, run the following command:

idsldapsearch -p port -D adminDN -w adminPWD -b base -s sub \
'(&(!(pwdChangedTime=*))(userPassword=*))' pwdChangedTime

Note: If a server contains many entries, the search might take considerable time. You must plan when to run the search.

To find all user entries for which passwords are about to expire, run the following command:

idsldapsearch -p port -D adminDN -w adminPWD -b base 
     -s sub '(userPassword=*)' pwdChangedTime

To query for locked accounts, use the pwdAccountLockedTime:

idsldapsearch –b "cn=users,o=sample" –s sub "(pwdAccountLockedTime=*)"  dn

To query for accounts for which the password must be changed because the password was reset, use the pwdReset attribute:

idsldapsearch –b "cn=users,o=sample" –s sub "(pwdReset=TRUE)"  dn