[Freeipa-users] Date of last access attribute

[Jakub Hrozek]

On Fri, Sep 13, 2013 at 07:47:46AM -0600, Rich Megginson wrote:
> On 09/13/2013 03:16 AM, Marina Moreda wrote:
> >Hi all,
> >
> >I need to add in my LDAP an attribute to save the date of last
> >access to mail account, or something similar, to know when an user
> >has stopped using his mail account. I can't find any attribute
> >like this one. Any suggestions on how I can do this?
> 
> 389 has a feature which keeps track of lastLoginTime - that is - the
> last time someone did a BIND to the LDAP server.  I don't know if
> IPA has a similar feature for Kerberos authentication.
> 
> 
> http://www.port389.org/wiki/Account_Policy_Design

In IPA, I think the closest match is krbLastSuccessfulAuth.