Password policy request control

Edit online

The Password policy request control explains its use with the server and provides the results.

Description
This control is sent by the client application with the requested operation. This control indicates to the server that this client understands Password Policy return values. If the client sends the Password policy request control with the request, the server can send the Password policy request control with the response. The Password policy request control contains extra information about why an operation failed because of a Password Policy problem. For example, if a client bind request failed because the user account is locked out. This information is sent to the client on the response in the Password Policy Response Control value field.
Note: If the Password Policy is disabled, then the Password policy request control is ignored, so no Password policy request control is sent with the response.
Request
OID
1.3.6.1.4.1.42.2.27.8.5.1
Syntax
There is no request value for the control.
Response
OID
1.3.6.1.4.1.42.2.27.8.5.1
Syntax
SEQUENCE { 
      warning   [0] CHOICE OPTIONAL { 
         timeBeforeExpiration  [0] INTEGER (0 .. MaxInt), 
         graceLoginsRemaining  [1] INTEGER (0 .. maxInt) } 
      error     [1] ENUMERATED OPTIONAL { 
         passwordExpired       (0), 
         accountLocked         (1), 
         changeAfterReset      (2), 
         passwordModNotAllowed (3), 
         mustSupplyOldPassword (4), 
         invalidPasswordSyntax (5), 
         passwordTooShort      (6), 
         passwordTooYoung      (7), 
         passwordInHistory     (8) } }
Behavior
This control is registered for the following operations:
  • Any
  • Add
  • Bind
  • Compare
  • Delete
  • Extended Operations
  • Search
  • Modify
  • Modrdn

All users are enabled to send the control.

This control has the following possible return codes:
  • LDAP_INSUFFICIENT_ACCESS
  • LDAP_INVALID_CREDENTIALS
  • LDAP_CONSTRAINT_VIOLATION
  • LDAP_UNWILLING_TO_PERFORM

The Administration Server supports this control. The Administration Server checks for this control on the bind operation, and returns the Password policy response control and values if needed. If the Root Administrator has too many bad binds in a row, the Administration Server locks out the account. It sends the Password Policy response that the account is locked.

Scope
The control lasts for the term of one operation. This control indicates to the server that the client application has information about Password Policy. Therefore, the server sends a Password policy response control with its response. With this response control, there can be a response control value which contains the Password Policy error or warning code and message if one is required. The other back-ends have no knowledge of this control and so it is ignored.