Table of Contents
Advertisement
Inactivating Users and Roles
•
Warnings from the server of an impending password expiration will be issued
by all replicas. This information is kept locally on each server, so if a user binds
to several replicas in turn, they will be issued the same warning several times.
In addition, if the user changes the password, it may take time for this
information to filter to the replicas. If a user changes a password and then
immediately rebind, they may find that the bind fails until the replica registers
the changes.
•
You want the same bind behavior to occur on all servers, including masters
and replicas. Make sure to create the same password policy configuration
information on each server.
•
Account lockout counters many not work as expected in a multi-mastered
environment.
•
Entries that are created for replication (for example, the server identities) need
to have passwords that never expire. To make sure that these special users
have passwords that do not expire, add the
attribute to the entry and give it a value of
valid range).
Inactivating Users and Roles
You can temporarily inactivate a single user account or a set of accounts. Once
inactivated, a user cannot bind to the directory. The authentication operation will
fail.
Users and roles are inactivated using the operational attribute
When an entry contains the
server rejects the bind.
You use the same procedures for inactivating users and roles. However, when you
inactivate a role, you are inactivating the members of the role and not the role entry
itself. For more information about roles in general and how roles interact with
access control in particular, refer to Chapter 5, "Advanced Entry Management."
The rest of this section describes the following procedures:
•
Inactivating User and Roles Using the Console
•
Inactivating User and Roles Using the Command Line
•
Activating User and Roles Using the Console
•
Activating User and Roles Using the Command Line
266
Netscape Directory Server Administrator's Guide • January 2002
passwordExpirationTime
20380119031407Z
attribute with a value of
nsAccountLock
(the top of the
.
nsAccountLock
, the
true
Advertisement
Table of Contents
