The master server uses the replication bind failure timestamp
control to propagate the bind failure timestamp value to a read-only
replica server.
- Description
- A master server in a replication topology supports this control
only when the
ibm-replicateSecurityAttribute attribute
is set to true.
- A read-only replica notifies its master when a user attempts a
bind operation against it that results in password policy operational
attributes update. The read-only replica server notifies its master
server only if the following conditions are met:
- The
ibm-replicateSecurityAttribute attribute
is set on a read-only replica server.
- The
ibm-replicareferralURL attribute is set with
the IP address or fully qualified domain name with ports of all its
master servers.
- The read-only replica server notifies its master server and provides
the following values:
- Passes the replication bind failure timestamp control.
- Binds with the user credentials that resulted in password policy
operational attributes update.
- If the
ibm-replicateSecurityAttribute attribute
is set on the master server, it propagates bind failure timestamp
value to the read-only replica in its response. The read-only replica
records the failure timestamp in its database for the user entry.
Therefore, both the read-only replica and master server record the
same password failure timestamp for the bind.
- If the
ibm-replicateSecurityAttribute attribute
is not set on the master server, the master server does not interpret
the control that it receives from the read-only replica. If the master
is unable to interpret the control, it does not return the password
failure timestamp in its response to the read-only replica. However,
master server updates its password failure count and then replicates
it to other servers. If the read-only replica does not receive the
password failure timestamp from the master, it records the password
failure timestamp at its end in the database.
- OID
1.3.18.0.2.10.34- Syntax
- The master server sets the response value with the bind failure
timestamp in the string format.
- Behavior
- This control is registered only for a bind operation.
- A read-only replica server sends the control to an identified
master as an internal request along with the bind operation by using
the same user credentials. The read-only replica sends the request
when a user attempts a bind operation that results in invalid credentials,
password expiration, or password grace use time. In the control response,
the master server sends a timestamp value of invalid credentials,
password expiration, or password grace use time to the read-only replica.
Only a master server supports this control and is meant for an RDBM
back-end server.
- Any user can send this control. A master server expects this control
from a read-only replica. If any external client or user sends this
control, the master server functions returns a password failure timestamp.
It is a non-critical control and return code does not vary.
- No additional information is required for the control. The master
server ignores any additional information that is receives. The return
response from the master server might contain a password failure timestamp
value.
- A read-only replica uses the
ldap_get_result_control call
to parse the response for the timestamp. If there is an error in the
format of the timestamp, the read-only replica takes the following
actions:
- Ignores the timestamp from the master server.
- Records the timestamp of the read-only replica in the user entry.
- This control operates independent of other controls. Therefore,
the control does not depend on other control and does not affect the
behavior of other controls.
- This control is not supported by the Administration Server.
- Scope
- The control lasts for one operation.
- Auditing
- In this control, the following information is audited:
- OID
- Timestamp in string format