Re: [squid-users] LDAP Auth + Passwd expiry

On Sun, Jun 15, 2003 at 05:54:06PM +0200, Frank Fegert wrote:
> we're using squid with the squid-ldap-auth helper to authenticate users &
> groups against NDS. The NDS uses password aging with three "goodwill"
> (whats the word in english?) logins after password expiration.

We use basically the same setup. The "goodwill" is called "intruder
lockout" in Novell slang.

> The problem right now is that the squid-auth helper consumes all "goodwill"
> logins after a password has expired, without informing the user about
> that fact. Thus the next logon to the OS is denied and the user has no
> chance to change his password.
> Is there a way to circumvent this problem?

The authentication cache in Squid distinguishes between positive
authentication (username and password matched) and negative
authentication (username/password mismatch). So the only case that a
user accidentally gets locked out is when he really tries to enter the
same (wrong) password three times. We are running LDAP authentication
against an NDS, too. During normal operation there are no users locked
out.

But maybe you talk about something else.

 Christoph

-- 
~
~
".signature" [Modified] 3 lines --100%--                3,41         All