NAME

       slapo-lastbind - lastbind overlay to slapd

SYNOPSIS

       ETCDIR/slapd.conf

DESCRIPTION

       The lastbind overlay to slapd(8) allows recording the timestamp of the last successful bind to entries in
       the directory, in the authTimestamp attribute.  The overlay can be configured to  update  this  timestamp
       only  if  it  is  older  than  a  given value, thus avoiding large numbers of write operations penalizing
       performance.  One sample use for this overlay would be to detect unused accounts.

       Now that OpenLDAP has native support for most of this functionality, storing the value in  pwdLastSuccess
       to better interact with the Behera Password Policy draft 10. Unless you require lastbind_forward_updates,
       you should consider using that instead.

CONFIGURATION

       The config directives that are specific to the lastbind overlay must be prefixed by lastbind-,  to  avoid
       potential conflicts with directives specific to the underlying database or to other stacked overlays.

       overlay lastbind
              This directive adds the lastbind overlay to the current database, see slapd.conf(5) for details.

       This  slapd.conf  configuration  option  is  defined  for  the lastbind overlay. It must appear after the
       overlay directive:

       lastbind-precision <seconds>
              The value <seconds> is the number of seconds after which to update the authTimestamp attribute  in
              an  entry.  If  the  existing  value  of  authTimestamp is less than <seconds> old, it will not be
              changed.  If this configuration option is omitted, the authTimestamp attribute is updated on  each
              successful bind operation.

       lastbind_forward_updates
              Specify  that  updates  of  the  authTimestamp  attribute  on  a consumer should be forwarded to a
              provider instead of being written directly into the consumer's local  database.  This  setting  is
              only  useful  on a replication consumer, and also requires the updateref setting and chain overlay
              to be appropriately configured.

EXAMPLE

       This example configures the lastbind overlay to store authTimestamp in all entries in a database, with  a
       1 week precision.  Add the following to slapd.conf(5):

           database <database>
           # ...

           overlay lastbind
           lastbind-precision 604800

       slapd must also load lastbind.la, if compiled as a run-time module;

FILES

       ETCDIR/slapd.conf
              default slapd configuration file

SEE ALSO

       slapd.conf(5), slapd(8).

       IETF  LDAP  password  policy  proposal  by P. Behera, L.  Poitou and J.  Sermersheim:  documented in IETF
       document "draft-behera-ldap-password-policy-10.txt".

       The slapo-lastbind(5) overlay supports dynamic configuration via back-config.

ACKNOWLEDGEMENTS

       This module was written in 2009 by Jonathan Clarke. It  is  loosely  derived  from  the  password  policy
       overlay.