draft-behera-ldap-password-policy-xx.txt

      D.  Calculates whether the time before expiration warning should 
          be sent.  
    


 
Behera, et. al.        Expires August 15, 2004                 Page 18

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
          If the pwdExpireWarning attribute is present and contains a 
          value, the server MUST perform the following steps. 
    
                    If the pwdExpirationWarned attribute is present and has a 
             time value, the warning time is the value of the 
             pwdExpirationWarned attribute plus the value of the 
             pwdExpireWarning attribute minus the current time. 
              
                    If the pwdExpirationWarned attribute is not present, the 
             server MUST subtract the current time from the time stored 
             in pwdChangedTime to arrive at the password's age. If the 
             age is greater than the value of the pwdMaxAge attribute 
             minus the value of the pwdExpireWarning attribute, the 
             server MUST set the current time as the value of the 
             pwdExpirationWarned attribute, and the warning time is the 
             value of pwdMaxAge minus the password's age. 
       
                    If the warning time is a positive number, the server MUST 
             send a bindResponse with the resultCode: success (0), and 
             MUST include the passwordPolicyResponse in the controls 
             field of the bindResponse message with the warning: 
             timeBeforeExiration set to the value as described above. 
       
                    If the warning time is zero, or wasn't calculated, the 
             server MUST send a bindResponse with the resultCode: 
             success (0), and MUST include the passwordPolicyResponse 
             with nothing in the SEQUENCE. 
       
          If the pwdExpireWarning attribute is not present, the server 
          MUST send a bindResponse with the resultCode: success (0), 
          and MUST include the passwordPolicyResponse with nothing in 
          the SEQUENCE. 
        
             If the bind operation fails authentication due to invalid 
      credentials, the server MUST do the following: 
       
      A.  Add the current time as a value of the pwdFailureTime 
          attribute. 
           
      B.  If the pwdLockout attribute is TRUE, the server MUST also do 
          the following: 
       
                    Count the number of values in the pwdFailureTime attribute 
             that are younger than pwdFailureCountInterval.  
    
                    If the number of these failures is greater or equal to the 
             pwdMaxFailure attribute, the server MUST lock the account 
             by setting the value of the pwdAccountLockedTime attribute 
             to the current time. After locking the account, the server 

 
Behera, et. al.        Expires August 15, 2004                 Page 19

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
             MUST send a bindResponse to the client with the 
             resultCode: unwillingToPerform (53), and MUST include the 
             passwordPolicyResponse in the controls field of the 
             bindResponse message with the error: accountLocked (1). 
    
             If the number of failures is less than the pwdMaxFailure 
             attribute, operation proceeds. 
           
      C.  Failure times that are old by more than 
          pwdFailureCountInterval are purged from the pwdFailureTime 
          attribute. 
           
    
        
6.2. Modify Password Operation 
    
   Because the password is stored in an attribute, the modify operation 
   may be used to create or update a password. But some alternate 
   mechanisms have been defined or may be defined, such as the LDAP 
   Password Modify Extended Operation [RFC-3062]. 
    
    
    
    
   While processing a password modification, the server MUST perform 
   the following steps: 
    
   1. Check the pwdSafeModify attribute. If set to TRUE, the server 
      MUST ensure that the modify password operation included the 
      user's existing password. When the LDAP modify operation is used 
      to modify a password, this is done by specifying both a delete 
      action and an add or replace action, where the delete action is 
      first, and specifies the existing password, and the add or 
      replace action specifies the new password. Other password modify 
      operations SHOULD employ a similar mechanism. Otherwise this 
      policy will fail.  
    
      If the existing password is not specified, the server MUST NOT 
      process the operation and MUST send the appropriate response 
      message to the client with the resultCode: unwillingToPerform 
      (53), and MUST include the passwordPolicyResponse in the controls 
      field of the response message with the error: 
      mustSupplyOldPassword (4). 
    
   
   2. Check the value of the pwdMustChange attribute. If TRUE, the 
      server MUST check the pwdReset attribute in the user's entry, to 
      see if a directory administrator has reset the password. If so, 
      it MUST ensure that the modify password operation contains no 

 
Behera, et. al.        Expires August 15, 2004                 Page 20

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
      modifications other than the modification of the password 
      attribute. If other modifications exist, the server MUST send a 
      response message to the client with the resultCode: 
      unwillingToPerform (53), and MUST include the 
      passwordPolicyResponse in the controls field of the response 
      message with the error: changeAfterReset (2). 
   
   3. Check to see whether the bound identity has sufficient rights to 
      modify the password. If the bound identity is a user changing its 
      own password, this MAY be done by checking the pwdAllowUserChange 
      attribute or using an access control mechanism. The determination 
      of this is implementation specific. If the user is not allowed to 
      change her password, the server MUST send a response message to 
      the client with the resultCode: unwillingToPerform (53), and MUST 
      include the passwordPolicyResponse in the controls field of the 
      response message with the error: passwordModNotAllowed (3). 
   
   4. Check the value of the pwdMinAge attribute. If it is set to a 
      non-zero value, the server MUST subtract the current time from 
      the value of the pwdChangedTime attribute to arrive at the 
      password's age. If the password's age is less than the value of 
      the pwdMinAge attribute, the password is too young to modify. In 
      this case, the server MUST send a response message to the client 
      with the resultCode: constraintViolation (19), and MUST include 
      the passwordPolicyResponse in the controls field of the response 
      message with the error: passwordTooYoung (7). 
   
   5. Check the value of the pwdCheckQuality attribute.  
   
      If the value is non-zero, The server: 
      
      A.  MUST ensure that the password meets the quality criteria 
          enforced by the server. This enforcement is implementation 
          specific. 
       
          If the server is unable to check the quality (due to a hashed 
          password or otherwise), the value of pwdCheckQuality is 
          evaluated. If the value is 1, operation MUST continue. If the 
          value is 2, the server MUST send a response message to the 
          client with the resultCode: constraintViolation (19), and MUST 
          include the passwordPolicyResponse in the controls field of 
          the response message with the error: 
          insufficientPasswordQuality (5). 
       
          If the server is able to check the password quality, and the 
          check fails, the server MUST send a response message to the 
          client with the resultCode: constraintViolation (19), and MUST 
          include the passwordPolicyResponse in the controls field of 


 
Behera, et. al.        Expires August 15, 2004                 Page 21

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
          the response message with the error: 
          insufficientPasswordQuality (5). 
       
      B.  MUST check the value of the pwdMinLength attribute. If the 
          value is non-zero, it MUST ensure that the new password is of 
          at least the minimum length. 
       
          If the server is unable to check the length (due to a hashed 
          password or otherwise), the value of pwdCheckQuality is 
          evaluated. If the value is 1, operation MUST continue. If the 
          value is 2, the server MUST send a response message to the 
          client with the resultCode: constraintViolation (19), and MUST 
          include the passwordPolicyResponse in the controls field of 
          the response message with the error: passwordTooShort (6). 
       
          If the server is able to check the password length, and the 
          check fails, the server MUST send a response message to the 
          client with the resultCode: constraintViolation (19), and MUST 
          include the passwordPolicyResponse in the controls field of 
          the response message with the error: passwordTooShort (6). 
        
   6. Check the value of the pwdInHistory attribute. If the value is 
      non-zero, the server MUST check whether this password exists in 
      the entry's pwdHistory attribute or in the current password 
      attribute. If the password does exist in the pwdHistory attribute 
      or in the current password attribute, the server MUST send a 
      response message to the client with the resultCode: 
      constraintViolation (19), and MUST include the 
      passwordPolicyResponse in the controls field of the response 
      message with the error: passwordInHistory (8). 
   
   If the steps have completed without causing an error condition, the 
   server MUST follow the following steps in order to update the 
   necessary password policy state attributes: 
    
   7. Check the value of the pwdMaxAge attribute. If the value is non-
      zero, or if the value of the pwdMinAge attribute is non-zero, the 
      server MUST update the pwdChangedTime attribute on the entry to 
      the current time. 
   
   8. If the value of the pwdInHistory attribute is non-zero, the 
      server MUST add the previous password to the pwdHistory 
      attribute. If the number of attributes held in the pwdHistory 
      attribute exceeds the value of pwdInHistory, the server MUST 
      remove the oldest excess passwords. 
   
   9. Remove the pwdFailureTime, pwdReset, pwdGraceUseTime and 
      pwdExpirationWarned attributes from the user's entry if they 


 
Behera, et. al.        Expires August 15, 2004                 Page 22

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
      exist. 
       
   The server MUST then apply the modify password operation. 
    
6.3. Add Operation 
    
   The password MAY be set during an Add operation. If it is, the 
   server MUST perform the following steps while processing the add 
   operation. Note that these are essentially duplicates of steps 3, 5 
   and 7 from Section 6.2 with the exception that pwdAllowUserChange is 
   not checked. 
    
   1. Check to see whether the bound identity has sufficient rights to 
      modify the password. This MAY be done by the use of an access 
      control mechanism. If the user is not allowed to add this 
      password, the server MUST send an addResponse to the client with 
      the resultCode: unwillingToPerform (53), and MUST include the 
      passwordPolicyResponse in the controls field of the addResponse 
      message with the error: passwordModNotAllowed (3). 
   
   2. Check the value of the pwdCheckQuality attribute.  
   
      If the value is non-zero, The server: 
      
      A.  MUST ensure that the password meets the quality criteria 
          enforced by the server. This enforcement is implementation 
          specific. 
       
          If the server is unable to check the quality (due to a hashed 
          password or otherwise), the value of pwdCheckQuality MUST be 
          evaluated. If the value is 1, operation MUST continue. If the 
          value is 2, the server MUST send an addResponse to the client 
          with the resultCode: constraintViolation (19), and MUST 
          include the passwordPolicyResponse in the controls field of 
          the addResponse message with the error: 
          insufficientPasswordQuality (5). 
       
          If the server is able to check the password quality, and the 
          check fails, the server MUST send an addResponse to the client 
          with the resultCode: constraintViolation (19), and MUST 
          include the passwordPolicyResponse in the controls field of 
          the addResponse message with the error: 
          insufficientPasswordQuality (5). 
       
      B.  MUST check the value of the pwdMinLength attribute. If the 
          value is non-zero, it MUST ensure that the new password is of 
          at least the minimum length. 
       

 

Behera, et. al.        Expires August 15, 2004                 Page 23

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
          If the server is unable to check the length (due to a hashed 
          password or otherwise), the value of pwdCheckQuality MUST be 
          evaluated. If the value is 1, operation MUST continue. If the 
          value is 2, the server MUST send an addResponse to the client 
          with the resultCode: constraintViolation (19), and MUST 
          include the passwordPolicyResponse in the controls field of 
          the addResponse message with the error: passwordTooShort (6). 
       
          If the server is able to check the password length, and the 
          check fails, the server MUST send an addResponse to the client 
          with the resultCode: constraintViolation (19), and MUST 
          include the passwordPolicyResponse in the controls field of 
          the addResponse message with the error: passwordTooShort (6). 
     
   If the steps above have completed without causing an error 
   condition, the server MUST follow the steps below in order to update 
   the necessary password policy state attributes. 
    
   3. Check the value of the pwdMaxAge attribute. If the value is non-
      zero, or if the value of the pwdMinAge attribute is non-zero, the 
      server MUST update the pwdChangedTime attribute on the entry to 
      the current time. 
   
6.4. Compare Operation 
    
   The compare operation MAY be used to compare a password. This might 
   be performed when a client wishes to verify that user's supplied 
   password is correct. An example of this is an LDAP HTTP 
   authentication redirector. It may be desirable to use this rather 
   than performing a bind operation in order to reduce possible 
   overhead involved in performing a bind. Access Controls SHOULD be 
   used to restrict this comparison from being made. 
    
   If a server supports this behavior, it MUST comply with the 
   following. Otherwise the password policy described in this document 
   may be circumvented. 
    
   While comparing password attributes, the server MUST perform the 
   following steps: 
    
   1. Check for a locked account: 
    
      If the value of the pwdAccountLockedTime attribute is 0, or if 
      the current time is less than the value of the 
      pwdAccountLockedTime attribute added to the value of the 
      pwdLockoutDuration, the account is locked. 
       
      If the account is locked, the server MUST send a compareResponse 
      to the client with the resultCode: compareFalse (5), and MUST 
 

Behera, et. al.        Expires August 15, 2004                 Page 24

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
      include the passwordPolicyResponse in the controls field of the 
      compareResponse message with the error: accountLocked (1). 
       
      If the account is not locked, the server MUST proceed with the 
      compare operation. 
    
   2. If Access Controls permit, the server MUST proceed with compare 
      operation and MUST check the result. 
       
      If the result of the compare operation is true, the server MUST 
      do the following: 
 
      A.  Delete the pwdFailureTime attribute. 
 
      B.  Check for password expiration 
    
          The password has expired when either of the following 
          conditions is met: 
       
          -  If the value of the pwdExpireWarning attribute is 0, the 
             server MUST subtract the current time from the time stored 
             in pwdChangedTime to arrive at the password's age. If the 
             age is greater than the value in the pwdMaxAge attribute, 
             the password has expired.  
       
          -  If the value of the pwdExpireWarning attribute is non-
             zero, and the pwdExpirationWarned attribute is present and 
             has a time value, the server MUST subtract the current 
             time from the time stored in the pwdExpirationWarned to 
             arrive at the first warning age. If the age is greater 
             than the value in the pwdExpireWarning attribute, the 
             password has expired.  
       
          If the password has expired, the server MUST check for 
          remaining grace logins. 
       
                       If the pwdGraceUseTime attribute is present, the server 
             MUST count the number of values in that attribute and MUST 
             subtract it from the pwdGraceLoginLimit. A positive result 
             specifies the number of remaining grace logins. 
       
                       If there are remaining grace logins, the server MUST add a 
             new value with the current time in pwdGraceUseTime. Then 
             it MUST send a compareResponse with the resultCode: 
             compareTrue (6), and MUST include the 
             passwordPolicyResponse in the controls field of the 
             compareResponse message with the warning: 
             graceLoginsRemaining choice set to the number of grace 
             logins left. 
 

Behera, et. al.        Expires August 15, 2004                 Page 25

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
       
                       If there are no remaining grace logins, the server MUST 
             send a compareResponse with the resultCode: compareFalse 
             (5), and MUST include the passwordPolicyResponse in the 
             controls field of the compareResponse message with the 
             error: passwordExpired (0) set. 
          
          If the password has not expired, execution MUST continue. 
    
      C.  Calculate whether the time before expiration warning should be 
          sent.  
    
          If the pwdExpireWarning attribute is present and contains a 
          value, the server MUST perform the following steps. 
    
                    If the pwdExpirationWarned attribute is present and has a 
             time value, the warning time is the value of the 
             pwdExpirationWarned attribute plus the value of the 
             pwdExpireWarning attribute minus the current time. 
              
                    If the pwdExpirationWarned attribute is not present, the 
             server MUST subtract the current time from the time stored 
             in pwdChangedTime to arrive at the password's age. If the 
             age is greater than the value of the pwdMaxAge attribute 
             minus the value of the pwdExpireWarning attribute, the 
             server MUST set the current time as the value of the 
             pwdExpirationWarned attribute, and the warning time is the 
             value of pwdMaxAge minus the password's age. 
       
                    If the warning time is a positive number, the server MUST 
             send a compareResponse with the resultCode: compareTrue 
             (6), and MUST include the passwordPolicyResponse in the 
             controls field of the compareResponse message with the 
             warning: timeBeforeExiration set to the value as described 
             above. 
       
                    If the warning time is zero, or wasn't calculated, the 
             server MUST send a compareResponse with the resultCode: 
             compareTrue (6), and MUST include the 
             passwordPolicyResponse with nothing in the SEQUENCE. 
       
          If the pwdExpireWarning attribute is not present, the server 
          MUST send a compareResponse with the resultCode: compareTrue 
          (6), and MUST include the passwordPolicyResponse with nothing 
          in the SEQUENCE. 
           
      If the result of the compare operation is false, the server MUST 
      do the following: 
    
 

Behera, et. al.        Expires August 15, 2004                 Page 26

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
          A. Add the current time as a value of the pwdFailureTime 
             attribute. 
           
          B. If the pwdLockout attribute is TRUE, the server MUST do 
             the following: 
       
                Count the number of values in the pwdFailureTime 
                attribute that are younger than 
                pwdFailureCountInterval.  
    
                If the number of these failures is greater or equal to 
                the pwdMaxFailure attribute, the server MUST lock the 
                account by setting the value of the 
                pwdAccountLockedTime attribute to the current time. 
                After locking the account, the server MUST send a 
                compareResponse to the client with the resultCode: 
                compareFalse (5), and MUST include the 
                passwordPolicyResponse in the controls field of the 
                compareResponse message with the error: accountLocked 
                (1). 
    
                If the number of failures is less than the 
                pwdMaxFailure attribute, operation MUST proceed. 
    
             If the pwdLockout attribute is FALSE, operation MUST 
          continue. 
           
          C. Failure times that are old by more than 
             pwdFailureCountInterval, MUST be purged from the 
             pwdFailureTime attribute. 
           
          D. If no errors were returned, the server MUST send a 
             compareResponse with the resultCode: compareTrue (6), and 
             MUST include the passwordPolicyResponse with nothing in 
             the SEQUENCE. 
    
7. Client Implementation by LDAP operation 
 
   These sections illustrate possible scenarios for each LDAP operation 
   and define the types of responses that identify those scenarios. 
    
   The scenarios in the following operations assume that the client 
   attached a passwordPolicyRequest control to the request message of 
   the operation, and thus MAY receive a passwordPolicyResponse control 
   in the response message. In the event that the passwordPolicyRequest 
   control was not sent, no passwordPolicyRequest control is returned. 
   All other instructions remain the same. 
    
7.1. Bind Operation 
 

Behera, et. al.        Expires August 15, 2004                 Page 27

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
    
   For every bind response received, the client MUST check the 
   resultCode of the bindResponse and MUST check for a 
   passwordPolicyResponse to determine if any of the following 
   conditions are true and MAY prompt the user accordingly. 
    
   1. The password failure limit has been reached and the account is 
      locked.  The user needs to retry later or contact the directory 
      administrator to reset the password. 
    
      resultCode:               unwillingToPerform (53) 
      passwordPolicyResponse:           error: accountLocked (1) 
    
   2. The user is binding for the first time after the directory 
      administrator set the password. In this scenario, the client 
      SHOULD prompt the user to change his password immediately. 
   
      resultCode:               success (0) 
      passwordPolicyResponse:           error: changeAfterReset (2) 
    
   3. The password has expired but there are remaining grace logins. 
      The user needs to change it. 
    
      resultCode:               success (0) 
      passwordPolicyResponse:           warning: graceLoginsRemaining 
   
   4. The password has expired and there are no more grace logins.  The 
      user MUST contact the directory administrator in order to have 
      its password reset. 
    
      resultCode:               invalidCredentials (49) 
      passwordPolicyResponse:           error: passwordExpired (0) 
   
   5. The user's password will expire in n number of seconds. 
    
      resultCode:               success (0) 
      passwordPolicyResponse:           warning: timeBeforeExpiration 
    
7.2. Modify Operations 
    
7.2.1. Modify Request 
    
   If the application or client encrypts the password prior to sending 
   it in a password modification operation (whether done through 
   modifyRequest or another password modification mechanism), it SHOULD 
   check the values of the pwdMinLength, and pwdCheckQuality attributes 
   and SHOULD enforce these policies. 
    
7.2.2. Modify Response 
 

Behera, et. al.        Expires August 15, 2004                 Page 28

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
    
   If the modifyRequest operation was used to change the password, or 
   if another mechanism is used --such as an extendedRequest-- the 
   modifyResponse or other appropriate response MAY contain information 
   pertinent to password policy. The client MUST check the resultCode 
   of the response and MUST check for a passwordPolicyResponse to 
   determine if any of the following conditions are true and optionally 
   notify the user of the condition. 
    
   1. The user attempted to change her password without specifying the 
      old password but the password policy requires this. 
   
      resultCode:               unwillingToPerform (53) 
      passwordPolicyResponse:           error: mustSupplyOldPassword (4) 
   
   2. The user MUST change her password before submitting any other 
      LDAP requests. 
   
      resultCode:               unwillingToPerform (53) 
      passwordPolicyResponse:           error: changeAfterReset (2) 
   
   3. The user doesn't have sufficient rights to change his password. 
   
      resultCode:               unwillingToPerform (53) 
      passwordPolicyResponse:           error: passwordModNotAllowed (3) 
   
   4. It is too soon after the last password modification to change the 
      password. 
   
      resultCode:               constraintViolation (19) 
      passwordPolicyResponse:           error: passwordTooYoung (7) 
   
   5. The password failed quality checking. 
   
      resultCode:               constraintViolation (19) 
      passwordPolicyResponse:           error: 
      insufficientPasswordQuality (5) 
    
   6. The length of the password is too short. 
   
      resultCode:               constraintViolation (19) 
      passwordPolicyResponse:           error: passwordTooShort (6) 
   
   7. The password has already been used; the user MUST choose a 
      different one. 
   
      resultCode:               constraintViolation (19) 
      passwordPolicyResponse:           error: passwordInHistory (8) 
    
 

Behera, et. al.        Expires August 15, 2004                 Page 29

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
   
7.3. Add Operation 
    
   If a password is specified in an addRequest, the client MUST check 
   the resultCode of the addResponse and MUST check for a 
   passwordPolicyResponse to determine if any of the following 
   conditions are true and may prompt the user accordingly. 
   
   1. The user doesn't have sufficient rights to add this password. 
   
      resultCode:               unwillingToPerform (53) 
      passwordPolicyResponse:           error: passwordModNotAllowed (3) 
   
   2. The password failed quality checking. 
   
      resultCode:               constraintViolation (19) 
      passwordPolicyResponse:           error: 
      insufficientPasswordQuality (5) 
    
   3. The length of the password is too short. 
   
      resultCode:               constraintViolation (19) 
      passwordPolicyResponse:           error: passwordTooShort (6) 
   
   
7.4. Compare Operation 
    
   When a compare operation is used to compare a password, the client 
   MUST check the resultCode of the compareResponse and MUST check for 
   a passwordPolicyResponse to determine if any of the following 
   conditions are true and MAY prompt the user accordingly. These 
   conditions assume that the result of the comparison was true. 
    
   1. The password failure limit has been reached and the account is 
      locked.  The user needs to retry later or contact the directory 
      administrator to reset the password. 
    
      resultCode:               compareFalse (5) 
      passwordPolicyResponse:           error: accountLocked (1) 
    
   2. The password has expired but there are remaining grace logins. 
      The user needs to change it. 
    
      resultCode:               compareTrue (6) 
      passwordPolicyResponse:           warning: graceLoginsRemaining  
   
   3. The password has expired and there are no more grace logins.  The 
      user MUST contact the directory administrator to reset the 
      password. 
 

Behera, et. al.        Expires August 15, 2004                 Page 30

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
    
      resultCode:               compareFalse (5) 
      passwordPolicyResponse:           error: passwordExpired (0) 
    
   4. The user's password will expire in n number of seconds. 
    
      resultCode:               compareTrue (6) 
      passwordPolicyResponse:           warning: timeBeforeExpiration  
    
 
7.5. Other Operations 
    
   For operations other than bind, unbind, abandon, search or StartTLS, 
   the client MUST check the following result code and control to 
   determine if the user needs to change the password immediately. 
    
   1. The user needs to change password. The user SHOULD be prompted to 
      change the password immediately. 
 
      resultCode:               unwillingToPerform (53) 
      passwordPolicyResponse:           error: changeAfterReset (2) 
 
8. Administration of a Password Policy 
    
    
   A password policy MUST be defined for a particular subtree of the 
   DIT by adding to an LDAP subentry whose immediate superior is the 
   root of the subtree, the pwdPolicy auxiliary object class. 
   The scope of the password policy is defined by the 
   SubtreeSpecification attribute of the LDAP subentry as specified in 
   RFC 3672 [RFC-3672]. 
    
   It is possible to define password policies for different password 
   attributes within the same pwdPolicy entry, by specifying multiple 
   values of the pwdAttribute. But password policies could also be in 
   separate sub entries as long as they are contained under the same 
   LDAP subentry. 
    
   Modifying the password policy MUST not result in any change in 
   users' entries to which the policy applies. 
    
   It SHOULD be possible to overwrite the password policy for one user 
   by defining a new policy in a subentry of the user entry. 
    
   Each object that is controlled by password policy SHALL advertise 
   the subentry that is being used to control its policy in its 
   pwdPolicySubentry attribute. Clients wishing to examine or manage 
   password policy for an object, MUST interrogate the 

 

Behera, et. al.        Expires August 15, 2004                 Page 31

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
   pwdPolicySubentry for that object in order to arrive at the proper 
   pwdPolicy subentry. 
    
9. Password Policy and Replication 
    
   The pwdPolicy object defines the password policy for a portion of 
   the DIT and MUST be replicated on all the replicas of this subtree, 
   as any subentry would be, in order to have a consistent policy among 
   all replicated servers. 
    
   The elements of the password policy that are related to the users 
   are stored in the entry themselves as operational attributes. 
   As these attributes are subject to modifications even on a read-only 
   replica, replicating them must be carefully considered. 
    
   The pwdChangedTime attribute MUST be replicated on all replicas, to 
   allow expiration of the password. 
    
   The pwdReset attribute MUST be replicated on all replicas, to deny 
   access to operations other than bind and modify password. 
     
   The pwdHistory attribute MUST be replicated to writable replicas. It 
   doesn't have to be replicated to a read-only replica, since the 
   password will never be directly modified on this server. 
    
   The pwdAccountLockedTime, pwdExpirationWarned, pwdFailureTime and 
   pwdGraceUseTime attributes MUST be replicated to writable replicas, 
   making the password policy global for all servers. 
   When the user entry is replicated to a read-only replica, these 
   attributes SHOULD NOT be replicated. This means that the number of 
   failures, of grace logins and the locking will take place on each 
   replicated server. For example, the effective number of failed 
   attempts on a user password will be N x M (where N is the number of 
   servers and M the value of pwdMaxFailure attribute). 
   Replicating these attributes to a read-only replica MAY reduce the 
   number of tries globally but MAY also introduce some inconstancies 
   in the way the password policy is applied. 
    
    
10. Security Considerations 
    
   This document defines a set of rules to implement in an LDAP server, 
   in order to mitigate some of the security risks associated with the 
   use of passwords and to make it difficult for password cracking 
   programs to break into directories.  
    
   Authentication with a password MUST follow the recommendations made 
   in RFC 2829 [RFC-2829].  
    
 

Behera, et. al.        Expires August 15, 2004                 Page 32

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
   Modifications of passwords SHOULD only occur when the connection is 
   protected with confidentiality and secure authentication. 
     
   Access controls SHOULD be used to restrict access to the password 
   policy attributes. Especially all the attributes defined to maintain 
   the Password Policy state information SHOULD not be modifiable by 
   anyone but the Administrator of the directory server. 
    
   As it is possible to define a password policy for one specific user 
   by adding a subentry immediately under the user's entry, Access 
   Controls SHOULD be used to restrict the use of the pwdPolicy object 
   class or the LDAP subentry object class. 
    
   When a password policy is put in place, the LDAP directory is 
   subject to a denial of service attack. A malicious user could 
   deliberately lock out one specific user's account (or all of them) 
   by sending bind requests with wrong passwords. There is no way to 
   protect against this kind of attack. The LDAP directory server 
   SHOULD log as much information as it can (such as client IP address) 
   whenever an account is locked, in order to be able to identify the 
   origin of the attack. Denying anonymous access to the LDAP directory 
   is also a way to restrict this kind of attacks. 
    
    
11. Acknowledgement 
 
   This document is based in part on prior work done by Valerie Chu 
   from Netscape Communications Corp, published as draft-vchu-ldap-pwd-
   policy-00.txt (December 1998). 
    
 
12. Normative References 
    
   [RFC-2119] S. Bradner, "Key Words for use in RFCs to Indicate 
   Requirement Levels", RFC 2119, March 1997. 
    
   [RFC-2195] J. Klensin, R. Catoe, P. Krumviede, "IMAP/POP AUTHorize 
   Extension for Simple Challenge/Response", RFC 2195, September 1997. 
    
   [RFC-2222] J. Myers, "Simple Authentication and Security Layer 
   (SASL)", RFC 2222, October 1997. 
    
   [RFC-2251] Wahl, M., Howes, T., Kille, S., "Lightweight Directory 
   Access Protocol (v3)", RFC 2251, August 1997. 
    
   [RFC-2252] Wahl, M., Coulbeck, A., Howes, T., Kille, S., 
   "Lightweight Directory Access Protocol (v3): Attribute Syntax 
   Definitions", RFC 2252, December 1997. 
    
 

Behera, et. al.        Expires August 15, 2004                 Page 33

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
   [RFC-Digest] Paul J. Leach, Chris Newman, "Using Digest 
   Authentication as a SASL Mechanism", RFC 2831, May 2000. 
    
   [RFC-3062] K. Zeilenga, "LDAP Password Modify Extended Operation", 
   RFC 3062, February 2001. 
    
   [RFC-3672] K. Zeilenga, S. Legg, "Subentries in the Lightweight 
   Directory Access Protocol (LDAP)", RFC 3672, December. 
    
 
13. Authors' Addresses 
    
   Prasanta Behera 
   18366 Chelmsford Dr. 
   Cupertino, CA 95014 
   USA 
   prasantabehera@yahoo.com 
    
   Ludovic Poitou 
   Sun Microsystems Inc. 
   180, Avenue de l'Europe 
   Zirst de Montbonnot 
   38334 Saint Ismier cedex 
   France 
   +33 476 188 212 
   ludovic.poitou@sun.com 
    
   Jim Sermersheim 
   Novell, Inc. 
   1800 South Novell Place 
   Provo, Utah 84606, USA 
   +1 801 861-3088 
   jimse@novell.com 
    
14. Copyright Notice 
    
   Copyright (C) The Internet Society (2004). All Rights  
   Reserved.   
     
   This document and translations of it may be copied and furnished to 
   others, and derivative works that comment on or otherwise explain it 
   or assist in its implementation may be prepared, copied, published 
   and distributed, in whole or in part, without restriction of any 
   kind, provided that the above copyright notice and this paragraph 
   are included on all such copies and derivative works. However, this 
   document itself may not be modified in any way, such as by removing 
   the copyright notice or references to the Internet Society or other 
   Internet organizations, except as needed for the purpose of 
   developing Internet standards in which case the procedures for 
 

Behera, et. al.        Expires August 15, 2004                 Page 34

INTERNET DRAFT           LDAP Password Policy         15 February 2004 
 
 
   copyrights defined in the Internet Standards process must be 
   followed, or as required to translate it into languages other than 
   English.  
     
   The limited permissions granted above are perpetual and will not be 
   revoked by the Internet Society or its successors or assigns.  
     
   This document and the information contained herein is provided on an 
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF  
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."  
    




































 
Behera, et. al.        Expires August 15, 2004                 Page 35