diff options
Diffstat (limited to 'ns-pwd-policy.schema')
| -rw-r--r-- | ns-pwd-policy.schema | 190 |
1 files changed, 190 insertions, 0 deletions
diff --git a/ns-pwd-policy.schema b/ns-pwd-policy.schema new file mode 100644 index 0000000..823b721 --- /dev/null +++ b/ns-pwd-policy.schema @@ -0,0 +1,190 @@ +#ident $Id: ns-pwd-policy.schema,v 1.2 2004/03/01 23:47:57 lukeh Exp $ +# +# Netscape password policy schema +# draft-vchu-ldap-pwd-policy-00.txt +# + +attributetype ( 2.16.840.1.113730.3.1.97 + NAME 'passwordMaxAge' + DESC 'the number of seconds after which user passwords will expire' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +attributetype ( 2.16.840.1.113730.3.1.98 + NAME 'passwordExp' + DESC 'a flag which indicates whether passwords will expire after a + given number of seconds' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) + +attributetype ( 2.16.840.1.113730.3.1.99 + NAME 'passwordMinLength' + DESC 'the minimum number of characters that must be used in a password' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +attributetype ( 2.16.840.1.113730.3.1.100 + NAME 'passwordKeepHistory' + DESC 'a flag which indicates whether passwords can be reused' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) + +attributetype ( 2.16.840.1.113730.3.1.101 + NAME 'passwordInHistory' + DESC 'the number of passwords the directory server stores in history' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +attributetype ( 2.16.840.1.113730.3.1.102 + NAME 'passwordChange' + DESC 'a flag which indicates whether users can change their passwords' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) + +attributetype ( 2.16.840.1.113730.3.1.103 + NAME 'passwordCheckSyntax' + DESC 'a flag which indicates whether the password syntax will be checked + before the password is saved' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) + +attributetype ( 2.16.840.1.113730.3.1.104 + NAME 'passwordWarning' + DESC 'the number of seconds before a users password is due to expire that + the user will be sent a warning message' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +attributetype ( 2.16.840.1.113730.3.1.105 + NAME 'passwordLockout' + DESC 'a flag which indicates whether users will be locked out of the + directory after a given number of consecutive failed bind attempts' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) + +attributetype ( 2.16.840.1.113730.3.1.106 + NAME 'passwordMaxFailure' + DESC 'the number of consecutive failed bind attempts after which a user + will be locked out of the directory' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +attributetype ( 2.16.840.1.113730.3.1.108 + NAME 'passwordUnlock' + DESC 'a flag which indicates whether a user will be locked out of the + directory for a given number of seconds or until the administrator + resets the password after an account lockout' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) + +attributetype ( 2.16.840.1.113730.3.1.109 + NAME 'passwordLockoutDuration' + DESC 'the number of seconds that users will be locked out of the directory + after an account lockout' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +attributetype ( 2.16.840.1.113730.3.1.220 + NAME 'passwordMustChange' + DESC 'a flag which indicates whether users must change their passwords when + they first bind to the directory server' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) + +attributetype ( 2.16.840.1.113730.3.1.221 + NAME 'passwordStorageScheme' + DESC 'the type of hash algorithm used to store directory server passwords' + EQUALITY caseIgnoreMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) + +attributetype ( 2.16.840.1.113730.3.1.222 + NAME 'passwordMinAge' + DESC 'the number of seconds that must elapse before a user can change their + password again' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +attributetype ( 2.16.840.1.113730.3.1.223 + NAME 'passwordResetFailureCount' + DESC 'the number of seconds after which the password failure counter will + be reset' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +objectclass ( 2.16.840.1.113730.3.2.13 + NAME 'passwordPolicy' + AUXILIARY + SUP top + DESC 'Password Policy object class to hold password policy information' + MAY ( passwordMaxAge $ passwordExp $ passwordMinLength $ + passwordKeepHistory $ passwordInHistory $ passwordChange $ + passwordCheckSyntax $ passwordWarning $ passwordLockout $ + passwordMaxFailure $ passwordUnlock $ passwordLockoutDuration $ + passwordMustChange $ passwordStorageScheme $ passwordMinAge $ + passwordResetFailureCount ) + ) + +attributetype ( 2.16.840.1.113730.3.1.91 + NAME 'passwordExpirationTime' + DESC 'the time the entrys password expires' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + EQUALITY generalizedTimeMatch + ORDERING generalizedTimeOrderingMatch + SINGLE-VALUE USAGE dSAOperation ) + +attributetype ( 2.16.840.1.113730.3.1.92 + NAME 'passwordExpWarned' + DESC 'a flag which indicates whether a password expiration warning is sent + to the client' + EQUALITY booleanMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 + SINGLE-VALUE USAGE dSAOperation ) + +attributetype ( 2.16.840.1.113730.3.1.93 + NAME 'passwordRetryCount' + DESC 'the count of consecutive failed password attempts' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE-VALUE USAGE dSAOperation ) + +attributetype ( 2.16.840.1.113730.3.1.94 + NAME 'retryCountResetTime' + DESC 'the time to reset the passwordRetryCount' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + EQUALITY generalizedTimeMatch + ORDERING generalizedTimeOrderingMatch + SINGLE-VALUE USAGE dSAOperation ) + +attributetype ( 2.16.840.1.113730.3.1.95 + NAME 'accountUnlockTime' + DESC 'the time that the user can bind again after an account lockout' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + EQUALITY generalizedTimeMatch + ORDERING generalizedTimeOrderingMatch + SINGLE-VALUE USAGE dSAOperation ) + +attributetype ( 2.16.840.1.113730.3.1.96 + NAME 'passwordHistory' + DESC 'the history of users passwords' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 + EQUALITY octetStringMatch USAGE dSAOperation ) + +attributetype ( 2.16.840.1.113730.3.1.214 + NAME 'passwordAllowChangeTime' + DESC 'the time that the user is allowed change the password' + SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + EQUALITY generalizedTimeMatch + ORDERING generalizedTimeOrderingMatch + SINGLE-VALUE USAGE dSAOperation ) + +objectclass ( 2.16.840.1.113730.3.2.12 + NAME 'passwordObject' + AUXILIARY + SUP top + DESC 'Password object class to hold password policy information for each + entry' + MAY ( passwordExpirationTime $ passwordExpWarned $ passwordRetryCount $ + retryCountResetTime $ accountUnlockTime $ passwordHistory $ + passwordAllowChangeTime ) + ) + |