LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

Directory Server Security Policies
Global Security Attributes
In the Windows 2003 Active Directory Server, there are a number of attributes about the security
policies. In order to support account and password security policy enforcement, PAM_AUTHZ
is enhanced to support the global administrative security attributes listed in table 7–2.
They are used to define the policy rules and are all defined under dc=world,dc=hp,dc=com.
Only authorized users can access them. If you use the PAM_Authz enhancement to support the
account and password policy enforcement, you must configure LDAP-UX with a proxy user and
grant this proxy user read and search rights to search dc=world, dc=hp, dc=com.
Table 7-2 Global Security Attributes
DescriptionAttribute
This integer attribute defines the amount of time that an account is locked due
to the Lockout-Threshold being exceeded. This value is stored as a large integer
that represents the negative of the number of 100 nanosecond intervals from
the time the Lockout-Threshold is exceeded that must elapse before the account
is unlocked.
lockoutDuration
This integer attribute specifies the maximum amount of time a password is
valid. This value is stored as a large integer that represents the number of 100
nanosecond intervals from the time the password was set before the password
expires.
maxPwdAge
Security Policy Status Attributes
PAM_AUTHZ supports a list of attributes which hold the general security policy status
information for a particular user in the Netscape/Red Hat Directory Server shown as table 7–3.
Table 7-3 Security Policy Status Attributes
DescriptionAttribute
This attribute controls the behavior of the user account.
userAccountControl
This string attribute contains the NetBIOS or DNS names
of the computers running Windows NT Workstation or
Windows 2000 Professional from which the user can log
on. Each NetBIOS name is separated by a comma.
userWorkStations
This integer attribute defines the date and time that the
password for this account was last changed. This value
is stored as a large integer that represents the number of
100 nanosecond intervals since January 1, 1601 (UTC). If
this value is set to 0 and the userAccountControl
attribute does not contain the UF_DONT_EXPIRE_PASSWD
flag, then the user must set the password at the next logon.
pwdLastSet
This integer attribute specifies the time when the account
expires. This value represents the number of 100
nanosecond intervals since January 1, 1601 (UTC). A value
of 0 or 0x7FFFFFFFFFFFFFFF (9223372036854775807)
indicates that the account never expires.
accountExpires
This integer attribute specifies the date and time (UTC)
that this account was locked out. This value is stored as
a large integer that represents the number of 100
nanosecond intervals since January 1, 1601 (UTC). A value
of zero means that the account is not currently locked out.
lockoutTime
This integer attribute defines the number of hours that
the user is allowed to logon to the domain.
logonHours
PAM_AUTHZ Login Authorization 121