Page created: 15 Jul 2022 |
Page updated: 20 Jan 2023
Rather than a user automatically inheriting the default password policy, you can assign
a user to a particular password policy by including the
ds-pwp-password-policy-dn operational attribute in that user’s entry
with a value equal to the distinguished name (DN) of the desired password policy for
that user. This operational attribute is explicitly included in a user’s entry, or
generated by a virtual attribute, which makes it easy to apply a custom password policy
to a set of users based on a flexible set of criteria.
Create an LDIF file that adds the
ds-pwp-password-policy-dnattribute with the password policy DN you want to assign to that user.
This example creates the file assign.ldif with the following contents.
dn: uid=user.1,ou=People,dc=example,dc=com changetype: modify add: ds-pwp-password-policy-dn ds-pwp-password-policy-dn: cn=Demo Password Policy,cn=Password Policies,cn=config
To apply the modification to the user's entry, run
For this example, the file used is assign.ldif.
$ bin/ldapmodify --filename assign.ldif