dovecot - Dec 2018 - Password expiration: how to trigger it?

Dear Dovecot Team,

I'm in the (long) process of migrating my whole email infrastructure. Of
course, dovecot is in the place, and is working just fine.

Still, I have an issue: password expiration.

I'm now using FreeIPA backend for the user authentication, and it
includes the capacity to expire passwords. Basically, it's an LDAP with
fancy things, among them a field named krbPasswordExpiration (yes,
that's kerberos).

In order to make things simple, I'd rather NOT force my users to set up
a kerberos/gssapi/whatever on their personal computer (most of them will
just have blank gaze if I start talking about that).

Is there a way to make Dovecot use that field? It's apparently a simple
date in %Y%M%D%H%m%sZ format, so a pretty neat thing to test. If there's
some support for that in Dovecot, that is.

If not, as a last resort, I can configure the freeIPA to deactivate the
user if the password is expired, and this should push another field in
the user description. Would that be a possibility for Dovecot, in case
it can't use the datetime field as is?

Thank you for your support!

Cheers,

C.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: pEpkey.asc
Type: application/pgp-keys
Size: 1774 bytes
Desc: not available
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20181220/0e663226/attachment-0001.bin>

On 2018-12-21 05:56, C?dric Jeanneret wrote:
> Dear Dovecot Team,
> 
> I'm in the (long) process of migrating my whole email infrastructure. 
> Of
> course, dovecot is in the place, and is working just fine.
> 
> Still, I have an issue: password expiration.
> 
> I'm now using FreeIPA backend for the user authentication, and it
> includes the capacity to expire passwords. Basically, it's an LDAP with
> fancy things, among them a field named krbPasswordExpiration (yes,
> that's kerberos).
> 
> In order to make things simple, I'd rather NOT force my users to set up
> a kerberos/gssapi/whatever on their personal computer (most of them 
> will
> just have blank gaze if I start talking about that).
> 
> Is there a way to make Dovecot use that field? It's apparently a simple
> date in %Y%M%D%H%m%sZ format, so a pretty neat thing to test. If 
> there's
> some support for that in Dovecot, that is.
One option would be the post login script, see:
https://wiki.dovecot.org/PostLoginScripting

Can also hook a password expiry check in dovecot-lda to send periodic 
reminders, although that's a bit unorthodox.

-- 
Adi Pircalabu