[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Expiration times

On Friday 07 December 2007 11:23:56 Harald Barth wrote:

> I know that. I want to know if the user can get the expire date prior
> to the KDC having decided that it is now "soon" expired and somehow
> makes kinit warn about it.

If you're using hdb_ldap, and the user has access to the krb5PasswordEnd 
attribute for their account, yes. Whether this is convenient is another 
issue.

$ ldapsearch -LLL "(uid=bgmilne)" krb5PasswordEnd
SASL/GSSAPI authentication started
SASL username: bgmilne@RANGER.DNSALIAS.COM
SASL SSF: 56
SASL installing layers
dn: uid=bgmilne,ou=People,dc=ranger,dc=dnsalias,dc=com
krb5PasswordEnd: 20080106065926Z

> I want to know if any of the graphical X11 login thingies have the
> kinit warning functionality (the expired "soon" warning feature).

kdm warns me on login, just like the KDE screensaver warns me when I unlock 
the screensaver:

http://staff.telkomsa.net/~bgmilne/heimdal-kde-expiry-warning.png
http://staff.telkomsa.net/~bgmilne/heimdal-kde-expiry-warning1.png

Regards,
Buchan