如何在openldap中设置帐户到期日期
我希望在 openldap 中实施新的帐户策略，允许管理员设置用户帐户的到期日期。但是，我在对象类中找不到任何相关属性。
这与 pwdMaxAge 等密码属性无关。此策略的用途是订阅服务。一旦用户订阅服务器达到一定期限，管理员将设置订阅结束的帐户到期日期。如果在到期日期之前，用户将通过身份验证，并且在到期日期之后将无法通过身份验证。
在 openldap 中可以这样做吗？我google了一下，发现微软的ActiveDirectory有AccountExpirationDate属性。
I wish to implement a new account policy in openldap that allow an administrator to set expiry date of user accounts. However, I can't find any related attribute in the object classes.
This is nothing related to password attributes like pwdMaxAge. The usage of this policy is for a subscription service. Once user has subscribed the server for a certain period, the administrator will set the account expiry date where subscription ends. User is authenticated if before expiry date and will fail to authenticated beyond the expiry date.
Is that possible to do so in openldap? I google and found that Microsoft's ActiveDirectory has AccountExpirationDate attribute.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
OpenLDAP 或其覆盖层不直接支持帐户过期（甚至在
contrib/中也不支持）。Howard Chu 建议使用ppolicy的pwdMaxAge为此，它可以工作，但我发现这不太理想：如果您已经使用 ppolicy 来处理过期密码（除了过期帐户），它将与这些设置冲突，并且如果您已配置宽限登录（明智的做法），用户可以更改其密码，从而重置过期计时器。
所以这似乎是实现这一点的最佳方法（也是一个很好的方法）方式并非如此）的方法是运行一个外部任务，将（ppolicy 属性）pwdAccountLockedTime 设置为表示手动锁定帐户的幻数，该帐户无法由用户解锁。
此外部任务（很可能是一个 cronjob）可以通过以下方式实现：在循环访问用户记录时，从用户记录上的自定义属性（例如 expirationTime）读取到期日期/时间。这样您就可以将到期时间/日期存储在用户记录中，但当然锁定完全依赖于此外部任务的运行。
或者您可以编写自己的覆盖层。
There's no direct support for account expiration in OpenLDAP or it's overlays (not even in
contrib/).Howard Chu suggests using ppolicy's pwdMaxAge for this, which can be made to work, but I've found this less than ideal: If you're already using ppolicy for expiring passwords (in addition to expiring accounts), it will conflict with those settings and if you've configured grace logins (the sane thing to do), the user can change his password and thus reset the expiration timer.
So it seems the best way to implement this (and a good way it is not) is by running an external task that sets the (ppolicy attribute) pwdAccountLockedTime to the magic number that indicates a manually locked account, which cannot be unlocked by the user.
This external task (a cronjob, most likely) could be implemented in such a way that it reads the expiration date/time from a custom attribute (e.g. expirationTime) on the user record as it loops over them. That way you could store the expiration time/date on the user record, but of course the lockout relies entirely on this external task running.
Or you could write your own overlay.
查看密码策略扩展。从 OpenLDAP 2.3 开始支持它。您可能需要编写一些代码来实现所需的扩展请求/响应控件。
如果您使用 OpenLDAP，则可以使用动态对象覆盖。创建帐户时添加
objectClass=dynamicObject，并通过动态对象刷新请求设置适当的entryTTL。Have a look at the Password Policy extension. It is supported from OpenLDAP 2.3 onwards. You may need to write some code to implement the required extended request/response controls.
If you're using OpenLDAP, you can use the dynamic objects overlay. Add
objectClass=dynamicObjectwhen creating the account, and set an appropriateentryTTLvia the dynamic object refresh request.如果用户帐户类型为
shadowAccountshadowExpire一个>Use
shadowExpireif the user account is of typeshadowAccount从 OpenLDAP 2.5 开始，您可以使用 pwdEndTime 属性来自 ppolicy 覆盖层以实现帐户过期：
来自 规范草案 11：
Since OpenLDAP 2.5 you can use the pwdEndTime attribute from the ppolicy overlay to achieve account expiration:
Details from the spec draft 11:
无需详细介绍 - 看看上面提到的 PPolicy 覆盖。有用。你是对的，没有像 AD 中那样的“帐户过期时间”。
一种解决方案是运行计算帐户期限的脚本，添加/修改用户属性 pwdPolicySubentry 并将其设置为策略的 DN，该策略使 1 秒前的密码过期并且不允许用户更改密码。
没有客户端可以解决这个问题，但用户条目实际上仍然完好无损。
without getting to detailed - take a look at the PPolicy overlay mentioned above. It works. And you are correct, there is no "account expire time" like there is in AD.
One solution is to run a script that calculates the age of the account and add/modify the user attribute pwdPolicySubentry and set it to the DN of a policy that expires any password that is 1 second old and does not allow the user to change the password.
No client will get around that, and yet the user entry remains virtually intact.