[Freeipa-users] Date of last access attribute

[Rob Crittenden]

Dmitri Pal wrote:
> On 09/13/2013 05:16 AM, Marina Moreda wrote:
>> Hi all,
>>
>> I need to add in my LDAP an attribute to save the date of last access
>> to mail account, or something similar, to know when an user has
>> stopped using his mail account. I can't find any attribute like this
>> one. Any suggestions on how I can do this?
>>
>> Thanks so much.
>>
>>
>>
>> _______________________________________________
>> Freeipa-users mailing list
>> Freeipa-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/freeipa-users
>
> I think there are some operational, i.e. "meta" attributes that store
> information when some attribute was last modified so if there is a way
> to associate mail activity with a modification of some user attribute
> then you can check the time stamp of this modification rather than
> create a separate attribute. With a new attribute the question comes:
> who, when and how updates it and whether the software you have is
> capable of doing it? May be software already updates something on every
> activity for the account and if this is the case then operation
> attributes would help.

There is no mail-specific activity attribute. I think about the closest 
you could get is last successful Kerberos authentication 
(krblastsuccessfulauth), but again this isn't specific to mail activity 
(unless that is all the users can do).

Note too that this attribute is by default not replicated so if you have 
several IPA masters you'd need to check them all. This attribute not 
updated on LDAP binds.

rob