Hi,
For future reference, I have to use the filter
"(|(objectclass=ldapsubentry)(objectclass=passwordpolicy))",
not just "(objectclass=ldapsubentry)".
Simon
Richard Megginson wrote on 11/09/2005 06:18 PM:
Those attributes are operational, so you must explicitly ask for them
on
the ldapsearch command line e.g.
ldapsearch -b
'cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu'
passwordMaxAge passwordWarning passwordMinAge passwordExp
passwordGraceLimit
In addition, ldapsubentry objects are hidden from normal searches. You
must explicitly request objects of this type by adding the
(objectclass=ldapsubentry) to your search filter e.g.
'(|(objectclass=*)(objectclass=ldapsubentry))'
to get all regular entries and sub entries, or just
'(objectclass=ldapsubentry)'
to get only the sub entry objects.
Vsevolod (Simon) Ilyushchenko wrote:
> Hi,
>
> I finally found where the password expiration data are located. If I
> do a database export from the GUI, I can see the entry:
>
> ***
> dn:
>
cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu
>
> modifyTimestamp: 20051109200121Z
> modifiersName:
> uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo
> t
> passwordMaxAge: 864000000
> passwordWarning: 0
> passwordMinAge: 0
> passwordExp: on
> passwordGraceLimit: 0
> objectClass: ldapsubentry
> objectClass: passwordpolicy
> objectClass: top
> cn: cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu
> creatorsName:
> uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
> createTimestamp: 20051109200121Z
> nsUniqueId: 97b5d182-1dd111b2-80f8db9c-cc6f0000
> ***
>
> However, if I ldapsearch -b
>
'cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu'
>
>
> I'm not getting any subentries:
>
> ***
> # extended LDIF
> #
> # LDAPv3
> # base
>
<cn="cn=nsPwPolicyEntry,uid=ilyush,ou=People,dc=cshl,dc=edu",cn=nsPwPolicyContainer,ou=People,dc=cshl,dc=edu>
> with scope sub
> # filter: (objectclass=*)
> # requesting: ALL
> #
>
> # search result
> search: 3
> result: 0 Success
> ***
>
> I've tried connecting both as "cn=Manager" and "uid=admin".
>
> Is there a way to access these data programmatically using ldapsearch?
>
> Thanks,
> Simon
>
------------------------------------------------------------------------
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
"Think like a man of action, act like a man of thought."
Henri Bergson