When a user changes their own password, or when an administrator resets the password for another user, that password change takes place immediately, and the new password should be used for subsequent authentication attempts.
By default, the former password is also immediately removed from the user’s entry and can no longer be used to authenticate. However, PingDirectory server supports a feature called password retirement in which the user’s former password can continue to be valid for a limited period of time.
Password retirement is especially useful for accounts used to authenticate applications, and particularly for applications that run on multiple systems. After the account’s password is changed in the PingDirectory server, the application can continue trying to use the old password until it can be updated with the new one. Similarly, the application cannot be configured to use the new password before it is changed in the PingDirectory server because attempts to authenticate with that new password before the account has been updated will also fail. With password retirement, the password can be changed in the PingDirectory server in a way that allows either the new password or the former password to be accepted. This provides a window of time in which the application instances can be updated with the new password.
The following password policy configuration properties can be used to configure password retirement:
- The password retirement behavior that the server should exhibit. By default,
passwords are not retired. However, any number of the following values can be
used to enable retirement functionality:
retire-on-self-change— Indicates that self password changes should automatically cause the user’s former password to be retired unless the request includes the purge password request control.
retire-on-administrative-reset— Indicates that administrative password resets should cause the user’s former password to be retired unless the request includes the purge password request control.
retire-on-request-with-control— Indicates that the client can use the retire password request control to indicate that the user’s current password should be retired.
- The maximum length of time that the retired password should be considered valid. By default, this is set to one day.
The PingDirectory server also provides support for two
request controls that can be used to customize password retirement behavior. The retire
password request control can be used to explicitly indicate that the user’s current
password should be retired, even if the server would otherwise purge it. This control is
only allowed if the
password-retirement-behavior property includes a
retire-on-request-with-control. The purge password request
control can be used to explicitly indicate that the user’s current password should be
removed from the server even if it would have otherwise retired it for example, because
See the config/sample-dsconfig-batch-files/enable-retired-passwords.dsconfig batch file for more information about configuring password retirement.