I uuse exec module in ldap filter: filter = "(&(uid=%{User-Name})(o=COMPANY)(pwdChangedTime>=%{exec:/usr/bin/ data.pl})(!(pwdAccountLockedTime=*)))" perl script: #!/usr/bin/perl -w use strict; use warnings; use DateTime; my $swstecz = 7776000; my $imtemu = gen_filter($swstecz); print "$imtemu"; sub gen_filter { my ($warningtime) = @_; my $dt = DateTime->now; $dt->subtract(seconds => $warningtime); my $filtertime = $dt->strftime('%Y%m%d%H%M%SZ'); return $filtertime; } and this work fine. Thanks Alan. Regards BS 2014-03-13 21:51 GMT+01:00 Alan DeKok <aland@deployingradius.com>:

Bogdan Siara wrote: \\

...

I would like to add one more parameter to check attribute pwdchangedtime, for example: filter = "(&(uid=%{User-Name})(o=COMPANY)(pwdchangedtime>`date --date="90 day ago" "+%Y%m%d%H%M%S"T`))"

How to realize this trick?

It's just an LDAP query. See the LDAP documentation for how to write LDAP queries.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

On 17 Mar 2014, at 13:05, Alan DeKok <aland@deployingradius.com> wrote:

Bogdan Siara wrote:

...

I uuse exec module in ldap filter: filter = "(&(uid=%{User-Name})(o=COMPANY)(pwdChangedTime>=%{exec:/usr/bin/data.pl

Tou can just use %Y%m%H directly in FreeRADIUS.

No, he's generating a timestamp offset by -90 days.

Or in v3, use rlm_date.

It'd be a combination of preprocess (to get Event-Timestamp) %{integer:} %{date:} and %{expr:} if it all needs to be done internally without one letter expansions. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2