如何区分 ldap 中的锁，是某些管理员用户手动锁定还是由于密码尝试错误？

Question

I have a requirement that user account will be locked if user tries with multiple incorrect password and alternatively admin can also lock the account, for incorrect pwd attempts I can use the attribute "pwdAccountLockedTime" but is there any recommendation for the admin lock?

Answer 1

Generally, depending on your schema and password Policy, and as used within the popular slapo-ppolicy - Password Policy overlay and as defined in the " Draft-behera-ldap-password-policy "

pwdAccountLockedTime

   This attribute contains the time that the user's  account  was  locked.
   If  the  account has been locked, the password may no longer be used to
   authenticate the user to the directory.  If pwdAccountLockedTime is set
   to  000001010000Z,  the  user's account has been permanently locked and
   may only be unlocked by an administrator.