I'm trying to use DS6 built-in functionality for tracking user's last login time. I created a new password policy and enabled pwdKeepLastAuthTime attribute. Then I tried signing into Access Manager.
According to the documentation, an attribute pwdLastAuthTime should be added to the user entry, but it is not there.
Any ideas how I can get this to work?
Last login time is a feature provided with the new Directory Server password policy implementation introduced in DS 6 and is not part of the compatibility mode. Check the Directory Server password policy compatibility mode:
$ dsconf get-server-prop ... | grep 'pwd-compat'
pwd-compat-mode: DS5-compatible-mode
The Directory Server password policy compatibility mode must be advanced past DS5-compatible-mode:
$ ldapmodify ...
dn: cn=Password Policy,cn=config
changetype:modify
replace:pwdkeeplastauthtime
pwdkeeplastauthtime:TRUE
modifying entry cn=Password Policy,cn=config
ldap_modify: DSA is unwilling to perform
ldap_modify: additional info: (Password Policy: modify policy entry) "pwdKeepLastAuthTime: TRUE" is not supported in server mode DS5-compatible-mode ("cn=config" pwdCompat: 0).
$ dsconf pwd-compat ... to-DS6-migration-mode
$ dsconf get-server-prop ... | grep 'pwd-compat'
pwd-compat-mode: DS6-migration-mode
Now it should work. If not, please try binding directly to the directory server as the user (e.g., do an ldapsearch as that user) and check the entry.
Thanks for the tip. I had MMR configured and one DS was in DS6 mode, and the other was in DS5 compatible mode. That may have been causing the problem.
So far I have only been able to retrieve the attribute using ldapsearch and explicitly specifying pwdlastauthtime in the filter. Is there anyways an application can retrieve this programmatically?
the pwdLastAuthTime attribute is an operational attribute and must be explicitely listed in the attributes to be returned.
ldapsearch -b"ou=people,dc=example,dc=com" "uid=John" pwdLastAuthTime
Of course, this can be achieved programmatically using LDAP APIs such as the LDAP C-SDK, the LDAP Java-SDK or JNDI .
Regards,
Ludovic.
