HP UX Identity Security Software 3.9 Account policy plug-inattributes

NOTE:

Any attribute can be used for the memberofgroupattr value, but the MemberOf Plug-in only works if the value of the target attribute contains the DN of the member entry. For example, the member attribute contains the DN of the member's user entry:

member: uid=jsmith,ou=People,dc=example,dc=com

Some member-related attributes do not contain a DN, like the memberURL attribute. That attribute will not work as a value for memberofgroupattr, since the memberURL value is a URL and a non-DN value cannot work with the MemberOf Plug-in.

Parameter	Description
Entry DN	cn=MemberOf Plugin, cn=plugins, cn=config
Valid Range	Any Directory Server attribute
Default Value	member
Syntax	DirectoryString
Example	memberofgroupattr: member

3.9 Account policy plug-in attributes

An account left inactive for a significant time becomes vulnerable to attack. The Account Policy Plug-in helps protect an idle account by limiting the inactivity time. For more information about using this plug-in, see the HP-UX Directory Server administrator guide.

For advanced configuration of the Account Policy Plug-in, you can make adjustments to its configuration entry, cn=config,cn=Account Policy Plugin,cn=plugins,cn=config. The following table lists the attributes available for this entry.

Table 3-5

Attribute name	Valid values	Default value	Description
alwaysRecordLogin	no/yes	no	When set to yes, the plug-in records the last login time for
			all accounts that authenticate, whether they are covered by
			an account policy or not. By default, the last login time is
			recorded only for accounts that are covered by an account
			policy.
altStateAttrName	Any valid	createTimestamp	Controls which attribute is used to perform the account
	attribute name		inactivity calculation when the lastLoginTime attribute is
			missing. For example, the lastLoginTime attribute is missing
			in a newly created account.

168 Plug-in implemented server functionality reference