The PingDirectory server supports the use of a bypass-pw-policy privilege, which can skip password policy evaluation for operations on a per-user basis. If a user has this privilege, then they are allowed to perform operations on user entries that would normally be rejected by the password policy associated with the target entry.

Note:

The bypass-pw-policy privilege does not have any effect for bind operations.

Any user with this privilege will be permitted to perform operations against other users that would otherwise be rejected under the constraints associated with that user’s password policy, such as:

  • Setting a pre-encoded password
  • Setting a new password that wouldn't be accepted by one or more password validators
  • Setting a new password that already exists in a user's password history
Note:

These restrictions can also be circumvented on a per-operation basis using the password update behavior control.

If you have a set of users that should be subject to lesser or differing constraints than another set of users, you can create a new password policy with the desired constraints, if any, and assign it to the appropriate users. Learn more about assigning password policies to users.

  • To add the bypass-pw-policy privilege to a user entry, run the ldapmodify tool with the bypass-pw-policy subcommand. 
    $ bin/ldapmodify 
dn: uid=user.1,ou=People,dc=example,dc=com 
changetype: modify 
add: ds-privilege-name 
ds-privilege-name: bypass-pw-policy