<div dir="ltr"><div>If each IPA server tracks time of last auth independently, then one ipa server might disable an inactive account. But that account might be active on another servers. In a fail over case where the server that that account normally uses is down, the user would not have a usable account. </div>Is it possible to use the account policy plugin? Or is there a way to track time of last auth that is replicated. I need to have accounts that have been inactive for 90 days automatically disabled. </div><div class="gmail_extra"> <div class="gmail_quote">On Mon, Mar 21, 2016 at 11:22 AM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Bob wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> We currently have 18 master ODSEE servers that we use to provide authentication services to both Redhat, SuSE, and Solaris systems. We are looking to add IPA servers to environment. We have a requirement to track time of last authentication. With ODSEE, time of last authentication tracking is enabled with this: *dsconf set-server-prop pwd-keep-last-auth-time-enabled:on* Looking at the Redhat DS 9 documentation, I see an account policy plug-in: cn=Account Policy Plugin,cn=plugins,cn=config Looking <a href="http://thefreeipa.org" rel="noreferrer" target="_blank">thefreeipa.org</a> <<a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a>> pages on the server plugins, I do not see the account policy plugin listed. <a href="http://www.freeipa.org/page/Directory_Server" rel="noreferrer" target="_blank">http://www.freeipa.org/page/Directory_Server</a> Looking in the directory DT of a "VERSION: 4.2.0, API_VERSION: 2.156" installed on Redhat 7, I do see the account policy plugin in the config tree. Is the use of this account policy plugin supported with IPA? Should it work? </blockquote> IPA has its own password policy. You can get last successful authentication via krbLastSuccessfulAuth Don't let the attribute name mislead you, it is updated on every authentication. Also note that this is per-IPA master. It is not replicated. rob </blockquote></div> </div>