I uuse exec module in ldap filter: filter = "(&(uid=%{User-Name})(o=COMPANY)(pwdChangedTime>=%{exec:/usr/bin/ data.pl})(!(pwdAccountLockedTime=*)))" perl script: #!/usr/bin/perl -w use strict; use warnings; use DateTime; my $swstecz = 7776000; my $imtemu = gen_filter($swstecz); print "$imtemu"; sub gen_filter { my ($warningtime) = @_; my $dt = DateTime->now; $dt->subtract(seconds => $warningtime); my $filtertime = $dt->strftime('%Y%m%d%H%M%SZ'); return $filtertime; } and this work fine. Thanks Alan. Regards BS 2014-03-13 21:51 GMT+01:00 Alan DeKok <aland@deployingradius.com>:
Bogdan Siara wrote: \\
I would like to add one more parameter to check attribute pwdchangedtime, for example: filter = "(&(uid=%{User-Name})(o=COMPANY)(pwdchangedtime>`date --date="90 day ago" "+%Y%m%d%H%M%S"T`))"
How to realize this trick?
It's just an LDAP query. See the LDAP documentation for how to write LDAP queries.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html