Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 272 / 578

Inactivating Users and Roles
272 Netscape Directory Server Administrator’s Guide • August 2002
When configuration a password policy in a replicated environment, consider the
following points:
• Warnings from the server of an impending password expiration will be issued
by all replicas. This information is kept locally on each server, so if a user binds
to several replicas in turn, they will be issued the same warning several times.
In addition, if the user changes the password, it may take time for this
information to filter to the replicas. If a user changes a password and then
immediately rebind, they may find that the bind fails until the replica registers
the changes.
• You want the same bind behavior to occur on all servers, including masters
and replicas. Make sure to create the same password policy configuration
information on each server.
• Account lockout counters many not work as expected in a multi-mastered
environment.
• Entries that are created for replication (for example, the server identities) need
to have passwords that never expire. To make sure that these special users
have passwords that do not expire, add the
passwordExpirationTime
attribute to the entry and give it a value of
20380119031407Z
(the top of the
valid range).
Inactivating Users and Roles
You can temporarily inactivate a single user account or a set of accounts. Once
inactivated, a user cannot bind to the directory. The authentication operation will
fail.
Users and roles are inactivated using the operational attribute
nsAccountLock
.
When an entry contains the
nsAccountLock
attribute with a value of
true
, the
server rejects the bind.
You use the same procedures for inactivating users and roles. However, when you
inactivate a role, you are inactivating the members of the role and not the role entry
itself. For more information about roles in general and how roles interact with
access control in particular, refer to Chapter 5, “Advanced Entry Management.”
The rest of this section describes the following procedures:
• Inactivating User and Roles Using the Console
• Inactivating User and Roles Using the Command Line
• Activating User and Roles Using the Console