It is possible to automatically assign a custom password policy for a set of users using a virtual attribute. The virtual attribute can be configured so that it can use a range of criteria for selecting the entries for which the virtual attribute should appear.

  1. Create an LDIF file, which may be used to add a group to the server.
    dn: ou=Groups,dc=example,dc=com 
    objectClass: organizationalunit 
    objectClass: top 
    ou: Groups
    dn: cn=Engineering Managers,ou=groups,dc=example,dc=com 
    objectClass: groupOfUniqueNames 
    objectClass: top 
    cn: Engineering Managers
    uniqueMember: uid=user.0,ou=People,dc=example,dc=com ou: groups
  2. Use ldapmodify to add the entries to the server.
    $ bin/ldapmodify --defaultAdd --filename groups.ldif
  3. Use dsconfig to create a virtual attribute that will add the ds-pwp-pasword-policy-dn attribute with a value of cn=Demo Password Policy,cn=Password Policies,cn=config to the entries for all users that are members of the cn=Engineering Managers,ou=Groups,dc=example,dc=com group.
    $ bin/dsconfig create-virtual-attribute \ 
      --name "Eng Mgrs Password Policy" \ 
      --type user-defined \ 
      --set "description:Eng Mgrs Grp PWPolicy" \
      --set enabled:true \ 
      --set attribute-type:ds-pwp-password-policy-dn \ 
      --set "value:cn=Demo Password Policy,cn=Password Policies,cn=config" \ 
      --set "group-dn:cn=Engineering Managers,ou=Groups,dc=example,dc=com
  4. Use ldapsearch to verify that a user in the group contains the assigned password policy DN.
    $ bin/ldapsearch --baseDN dc=example,dc=com "(uid=user.0)" \ 
    dn: uid=user.0,ou=People,dc=example,dc=com 
    ds-pwp-password-policy-dn: cn=Demo Password Policy,cn=Password Policies,cn=config