Principal attributes and policy in LDAP Realm

[Ken Raeburn]

On Jun 9, 2008, at 04:52, Savitha R wrote:
>>>> On Sat, Jun 7, 2008 at  1:46 AM, in message
> <1212783367.27162.15.camel at klausk.br.ibm.com>, Klaus Heinrich Kiwi
> <klausk at linux.vnet.ibm.com> wrote:
>> Hi,
>>
>> I hav some questions regarding how data is organized when using the
>> LDAP KDB plugin for a realm. I hope this is the right place to ask.
>>
>> I have a Realm set-up using the LDAP backend. First thing is: when
>> querying a principal using kadmin, why attributes such as 'Last
>> [successful,failed] authentication' and 'Failed password attempts'  
>> are
>> never filled-up? After failing some authentication attempts I have  
>> the
>> following:
>> ...
>> Last modified: Fri Jun 06 16:24:09 BRT 2008 (klaus/admin at MYREALM)
>> Last successful authentication: [never]
>> Last failed authentication: [never]
>> Failed password attempts: 0
>> ...
>>
> These attributes are updated only when the KDC is built with the
> "--with-kdc-kdb-update" option.

Which, unfortunately, doesn't seem to work since the DAL merge that  
made the use of LDAP possible (e.g., RT tickets 5668, 5716 -- the  
latter has a patch I haven't had a chance to evaluate).

This probably should be made a runtime option -- or at least, have the  
configure-time option set a flag checked by code that's always  
compiled in.

Ken