[Fedora-directory-users] How to ldapsearch password expiration data?

[Richard Megginson]

Those attributes are operational, so you must explicitly ask for them on 
the ldapsearch command line e.g.
ldapsearch -b 
'cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu' 
passwordMaxAge passwordWarning passwordMinAge passwordExp passwordGraceLimit

In addition, ldapsubentry objects are hidden from normal searches.  You 
must explicitly request objects of this type by adding the 
(objectclass=ldapsubentry) to your search filter e.g.
'(|(objectclass=*)(objectclass=ldapsubentry))'
to get all regular entries and sub entries, or just
'(objectclass=ldapsubentry)'
to get only the sub entry objects.

Vsevolod (Simon) Ilyushchenko wrote:

> Hi,
>
> I finally found where the password expiration data are located. If I 
> do a database export from the GUI, I can see the entry:
>
> ***
> dn: 
> cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu 
>
> modifyTimestamp: 20051109200121Z
> modifiersName: 
> uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo
>  t
> passwordMaxAge: 864000000
> passwordWarning: 0
> passwordMinAge: 0
> passwordExp: on
> passwordGraceLimit: 0
> objectClass: ldapsubentry
> objectClass: passwordpolicy
> objectClass: top
> cn: cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu
> creatorsName: 
> uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
> createTimestamp: 20051109200121Z
> nsUniqueId: 97b5d182-1dd111b2-80f8db9c-cc6f0000
> ***
>
> However, if I ldapsearch -b
> 'cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu' 
>
>
> I'm not getting any subentries:
>
> ***
> # extended LDIF
> #
> # LDAPv3
> # base 
> <cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu> 
> with scope sub
> # filter: (objectclass=*)
> # requesting: ALL
> #
>
> # search result
> search: 3
> result: 0 Success
> ***
>
> I've tried connecting both as "cn=Manager" and "uid=admin".
>
> Is there a way to access these data programmatically using ldapsearch?
>
> Thanks,
> Simon
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3312 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20051109/a895c623/attachment.bin>