The Apache DS documentation (Advanced guide, chapter 2) mentions , in detail , all of the attributes that can be set for the password policy configuration.
Whilst some of the these work, ie we successfully manage to lock ourselves out after a configurable number of bad password attempts, we have found that one of them is not working? or perhaps we are using it incorrectly?
This is the pwdExpireWarning attribute. The documentation mentions this as follows (incorrectly specifying as a Boolean, when it should be a digit in seconds?).
"ads-pwdExpireWarning boolean 0 The maximum number of seconds before a password is due to expire, and that expiration warning messages will be returned to an authenticating user (0 means no message wil be sent to user)"
If we set ads-pwdMaxAge to 120 (just for test purposes), we correctly notice that the password does indeed expire after 120 seconds.
However, we also set ads-pwdExpireWarning to 60, hoping that after 60 seconds, when we try and login, (using Java JNDI code), we would get an error code indicating a warning that the password is about to expire. We get no such warnings, or maybe where should we look to notice this? Where should the Java code query to notice if such a warning has been flagged?
Does anyone know if this is a known issue, and in the current latest version of Apache DS, the ads-pwdExpireWarning attribute is not supported?