How To Change A User's Password So It Is Expired At First Logon With CA LDAP?

Article Id: 17701

Status: Published

Updated On: 21-03-2018 07:13

Legacy Id: TEC616522

Products:

CA ACF2 , CA ACF2 - DB2 Option , CA ACF2 for zVM , CA ACF2 - z/OS , CA ACF2 - MISC , CA-24X7 High-Availability Manager for DB2 for z/OS , CA-Batch Processor , Compile QQF , CA Data Compressor for DB2 for z/OS , CA NSM Database Option for z/OS , CA Log Compress , Online Reorg for DB2 for z/OS , CA RC/Update for DB2 for z/OS , RI Editor for DB2 for z/OS , DB2 TOOLS- DATABASE MISC , CA PanApt , CA PanAudit , CA Top Secret , CA Top Secret - LDAP

Issue/Introduction:

Description:

How to use CA-LDAP to change a user;s password so it is expired at first logon to force the user to replace it with a new one?

Solution:

With CA-LDAP you can change a user's password and have it expired like with the native TSS commands below:

TSS REP(#acid) PASSWORD(#password,,EXP) or

TSS REP(#acid) PASSWORD(#password,15,EXP) also to replace the password interval.

Use the ldapmodify command with option -f to point to an ldif file defined as follows:

LDIF File:

 *** Top Of Data ***       
 dn: tssacid=myacid,tssadmingrp=acids,host=yourHost,o=ca,c=us 
 changetype: modify
 replace: userPassword
 userPassword: USRPWD10
 -
 replace: ExpireNow
 ExpireNow: Y
 *** End Of Data ***

If you want to change the password interval, include the following in that ldif file:

 ***       
 - 
 replace: userPassword-Interval
 userPassword-Interval: 15
 ***

Below is an example of the ldapmodify command syntax:

./ldapmodify -x -D cn=ADMIN -w ADMINPASS -v -H ldaps://xxxxxx.xxxxxxxx.com:636 -ZZ -f ldiffile

The following url has more information about the ldif file:

http://en.wikipedia.org/wiki/LDAP_Data_Interchange_Format

Environment:

Release:
Component: TSSLDP