Re: CentOS OpenLDAP pwdReset Attribute

26 Oct 2021

      On Tuesday, October 26th, 2021 at 8:56 AM, Alan DeKok <aland@deployingradius.com> wrote:
...
You can always run an LDAP query manually via "unlang" to check the status of the pwdReset field.
For any future reader out there, as Alan suggested, this works perfectly fine. Hopefully it will help someone else:

sudo vim /etc/raddb/dictionary
ATTRIBUTE Password-Reset 3000 string

sudo vim /etc/raddb/mods-available/ldap
update{
  control:Password-Reset  += 'pwdReset'
}

sudo vim /etc/raddb/sites-available/default
post-auth {
    if (control:Password-Reset == "TRUE") {
        update reply {
            &Reply-Message := "Your password has been reset. You must change your password."
        }
        reject
    }
}

Thanks!

Re: CentOS OpenLDAP pwdReset Attribute

Th1am1dMonozoicK4runa