Ack from me, this seems quite simple.

The patch looks good but I miss how this password policy is enforced ?
I would expect any operation except MOD(userPassword) to be rejected and possibly a controlResult being sent. Is it already enforced with passwordExpirationTime ?

The patch looks good but I miss how this password policy is enforced ?
I would expect any operation except MOD(userPassword) to be rejected and possibly a controlResult being sent. Is it already enforced with passwordExpirationTime ?

We already enforce this, this RFE was to add a new attribute to the entry. It's basically redundant as the code already checks for "NO_TIME" to enforce password must be reset. But to be compatible with other LDAP vendors/clients we need this new attribute that makes it very clear the user must reset their password.

@mreynolds thanks for the explanation. You have my ACK as well

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3969

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.