Red Hat DIRECTORY SERVER 8.1 Command Reference Manual page 74

Chapter 2. Core Server Configuration Reference
2.3.1.117. passwordGraceLimit (Password Expiration)
This attribute is only applicable if password expiration is enabled. After the user's password has
expired, the server allows the user to connect for the purpose of changing the password. This is called
a grace login. The server allows only a certain number of attempts before completely locking out the
user. This attribute is the number of grace logins allowed. A value of 0 means the server does not
allow grace logins.
Parameter
Entry DN
Valid Values
Default Value
Syntax
Example
2.3.1.118. passwordGraceUserTime
This attribute counts the number of attempts the user has made with the expired password.
This is an operational attribute, meaning its value is managed by the server and the attribute is not
returned in default searches.
Parameter
Entry DN
Valid Values
Default Value
Syntax
Example
2.3.1.119. passwordHistory (Password History)
Enables password history. Password history refers to whether users are allowed to reuse passwords.
By default, password history is disabled, and users can reuse passwords. If this attribute is set to
on, the directory stores a given number of old passwords and prevents users from reusing any
of the stored passwords. Set the number of old passwords the Directory Server stores using the
passwordInHistory attribute.
For more information on password policies, see the "Managing Users and Passwords" chapter in the
Directory Server Administrator's Guide.
Parameter
Entry DN
Valid Values
Default Value
Syntax
Example
60
Description
cn=config
0 (off) to any reasonable integer
0
Integer
passwordGraceLimit: 3
Description
cn=config
none to any reasonable integer
none
Integer
passwordGraceUserTime: 1
Description
cn=config
on | off
off
DirectoryString
passwordHistory: on