Testing user password expiration with openldap

Question

I need to test whether our application can handle a user needing to change their password. I'm using the Docker openldap server available from here: https://github.com/osixia/docker-openldap.

I've added various things from here https://ldapwiki.com/wiki/Password%20MUST%20Change to my schema, however if I try to add pwdMustChange to a user, Apache Directory Studio will fail saying the schema doesn't allow for it.

This is what I've put in my schema:

attributetype ( PwdMustChange
NAME 'PwdMustChange'
DESC 'Password Must Be Changed'
EQUALITY booleanMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
)

Apache Directory Studio recognises the value as it autofills pwdMustChange, but when I try to enter a value in the above error occurs.

My question boils down to: How can I simulate a user password expiration with openldap?

Answer 1

Which programming language and which LDAP module for this are you using?

I'd suggest to do a bit more of reading:

• OpenLDAP 2.4 Admin Guide -- Configuring slapd because the Docker image you're using insists on using OpenLDAP's dynamic configuration backend
• OpenLDAP 2.4 Admin Guide -- Password Policies
• slapo-ppolicy(5) describes the meaning of all attributes in the pwdPolicy entry
• OpenLDAP implements this draft version: draft-behera-ldap-password-policy-09