How does LDAP-UX do password expiration?

[Nat Guyton]

I've tried setting the attributes in shadowAccount - shadowLastChange = 12514 and shadowMax = 60. When logging in, the system correctly identifies an expired password, and updates it accordingly, but never updates shadowLastChange, so I never login but get repeated requests to change the password (which I can do successfully). Changing the password via the passwd command functions similarly - userPassword gets updated but not shadowLastChange.

I put a packet sniffer on both my HP machine and Linux machine to see the differences - the Linux machine makes an addidional ldapmodify request to set the shadowLastChange after changing the password, but the HP machine does not.

Any ideas? Thanks!

[Nat Guyton]

Oh, and I've got the latest LDAP-UX: B.03.20 on an 11.11 system.

[Axel Barnitzke · Accepted solution]

I had the same problem and opened a call (1204501525) at HP.
By waiting for response I played a little around with this and I found a (surprising) solution:
Add
attributemap: shadow:shadowlastchange=passwordexpirationtime
to your ldapux_profile and the system handles the password expiration time (correct as I will explain later).

The handling is a bit weired. I would expect that the password now expires at: passwordexpirationtime + shadowmax
but in reality it expires at passwordexpirationtime!
Netscape/HP put some miracle in their ldapux implementation.
(Be carefull -- I checked this only once with one account.)

So the next thing ist to check whether we need a shadowaccount at all.

Does this happen just with the version 03.20 or does no HPUX user need password expiration?

Good luck