<div dir="ltr"><div>Thanks Rob. I have one more question. Is it possible to add a field in the ui, and get the field's value in a custom add user hook script ? </div><div>James </div></div><div class="gmail_extra"> <div class="gmail_quote">2013/2/7 Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class="im">James James wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Can somebody gives me some help to set krbPrincipalExpiration from the freeipa ui ? </blockquote> </div> You can't set this in the web UI. You can do it from the command line using ldapmodify with: $ ldapmodify -x -D 'cn=Directory Manager' -W Enter LDAP Password: dn: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com changetype: modify replace: krbPasswordExpiration krbPasswordExpiration: 20200508032114Z ^D rob <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Many thanks 2013/1/28 James James <<a href="mailto:jreg2k@gmail.com" target="_blank">jreg2k@gmail.com</a> <mailto:<a href="mailto:jreg2k@gmail.com" target="_blank">jreg2k@gmail.com</a>>><div class="im"> Hi Martin, thanks a lot for your answer. The krbPrincipalExpiration should do the job. Regards. </div> 2013/1/28 Martin Kosek <<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a> <mailto:<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>>><div><div class="h5"> On 01/28/2013 12:14 PM, James James wrote: > Hi, in 389-ds there is a nice plugin I love, it's account policy. You can set > account expiration date and the account will be inactive at this day. > > <a href="http://directory.fedoraproject.org/wiki/Account_Policy_Design#Detailed_Design_of_Account_Expiration" target="_blank">http://directory.fedoraproject.org/wiki/Account_Policy_Design#Detailed_Design_of_Account_Expiration</a> > > Is there a way to have this feature with freeipa ? > > Regards. > > > James > Hello James, FreeIPA user plugin does not support this feature, you would need to hack it in the plugin yourselves (patches welcome :-). Generally, you should be able to set account expiration to krbPrincipalExpiration attribute of the user account and it should just work. You can also check few tickets we have already few tickets filed for better handling of this attribute: <a href="https://fedorahosted.org/freeipa/ticket/3062" target="_blank">https://fedorahosted.org/freeipa/ticket/3062</a> [RFE] Allow admins to change expiration attribute for the accounts <a href="https://fedorahosted.org/freeipa/ticket/3305" target="_blank">https://fedorahosted.org/freeipa/ticket/3305</a> KrbPrincipalExpiration should be checked in pre-bind op <a href="https://fedorahosted.org/freeipa/ticket/3306" target="_blank">https://fedorahosted.org/freeipa/ticket/3306</a> [RFE] Expose the krbPrincipalExpiration attribute for editing in the IPA CLI / WEBUI Anyway, if you want a support for this particular plugin, you can file an RFE to Trac/Bugzilla which we will further process. HTH, Martin </div></div> _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </blockquote> </blockquote></div> </div>