samba - Feb 2017 - How to get password expiration?

On 02/02/2017 15:17, mathias dufresne wrote:
> So, back to ldapsearch -Y GSSAPI (if your users generate kerberos 
> ticket at connection time) to retrieve LDAP attribute PwdLastSet. It's 
> not an UNIX timestamp, it should be called LDAP time stamp or 18-digit 
> LDAP timestamp...
Aside: it's a Microsoft Win32 FILETIME. (The LDAP standard uses ISO times)

pwdLastSet doesn't tell you when it expires, so you'd have to combine 
this with the domain password expiry policy too: i.e. do the equivalent 
of "samba-tool domain passwordsettings show"

If he only wants to display the information to the user at login time, I 
think the best/easiest place to do this would be in the PAM module which 
enforces the password expiry, since it has all the information to hand 
already.

On Thu, 2 Feb 2017 15:49:57 +0000
Brian Candler via samba <samba at lists.samba.org> wrote:
> On 02/02/2017 15:17, mathias dufresne wrote:
> > So, back to ldapsearch -Y GSSAPI (if your users generate kerberos 
> > ticket at connection time) to retrieve LDAP attribute PwdLastSet.
> > It's not an UNIX timestamp, it should be called LDAP time stamp or
> > 18-digit LDAP timestamp...
> 
> Aside: it's a Microsoft Win32 FILETIME. (The LDAP standard uses ISO
> times)
> 
> pwdLastSet doesn't tell you when it expires, so you'd have to
combine
> this with the domain password expiry policy too: i.e. do the
> equivalent of "samba-tool domain passwordsettings show"
> 
> If he only wants to display the information to the user at login
> time, I think the best/easiest place to do this would be in the PAM
> module which enforces the password expiry, since it has all the
> information to hand already.
> 
> 
The problem isn't getting the expiry date and time (you can use the
rpcclient command for this), it is getting something to pop-up on the
users desktop with the data.

Rowland

This seems to work for maxPwdAge

ldapsearch -LLL -Q -s base -h ad.mydomain.tld -b dc=ad,dc=mydomain,dc=tld
maxPwdAge

now I just need to query a users pwdLastSetq
I tried the commands above but am not getting anything. I tried looking at
the ungrepped output but I don't see how to link the pwdLastSet with any
user. I get a long list.
I think I'm looking for dn: and a matching pwdLastSet? So I tried the
command bellow but I don't see anything that looks like users.


ldapsearch -h ad.mydomain.tld -b 'dc=ad,dc=mydomain,dc=tld' -D
'*@ad.mydomain.tld' -U myusername|grep -e "^pwdLastSet:" -e
"^dn:"|less
gives me as follows

dn: DC=ad,DC=mydomain,DC=tld
dn: CN=Computers,DC=ad,DC=mydomain,DC=tld
dn: CN=AD2,OU=Domain Controllers,DC=ad,DC=mydomain,DC=tld
pwdLastSet: 129912036833708410
dn: CN=DC1,OU=Domain Controllers,DC=ad,DC=mydomain,DC=tld
pwdLastSet: 131292041205350825
dn: OU=Domain Controllers,DC=ad,DC=mydomain,DC=tld
dn: CN=DC2,OU=Domain Controllers,DC=ad,DC=mydomain,DC=tld
pwdLastSet: 131300093694348218
dn: CN=OMEGA,OU=Domain Controllers,DC=ad,DC=mydomain,DC=tld
pwdLastSet: 129908837104473721
dn: CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=RID Manager$,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=Users,DC=ad,DC=mydomain,DC=tld
dn: CN=LostAndFound,DC=ad,DC=mydomain,DC=tld
dn: CN=Infrastructure,DC=ad,DC=mydomain,DC=tld
dn: CN=ForeignSecurityPrincipals,DC=ad,DC=mydomain,DC=tld
dn: CN=Program Data,DC=ad,DC=mydomain,DC=tld
dn: CN=Microsoft,CN=Program Data,DC=ad,DC=mydomain,DC=tld
dn: CN=NTDS Quotas,DC=ad,DC=mydomain,DC=tld
dn: CN=Managed Service Accounts,DC=ad,DC=mydomain,DC=tld
dn: CN=WinsockServices,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=RpcServices,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=FileLinks,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=VolumeTable,CN=FileLinks,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=ObjectMoveTable,CN=FileLinks,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=Default Domain Policy,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=AppCategories,CN=Default Domain
Policy,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=Meetings,CN=System,DC=ad,DC=mydomain,DC=tld
dn: CN=Policies,CN=System,DC=ad,DC=mydomain,DC=tld
...