When we try to create an account in Solaris using Unix v2 connector we get this error message:
:ETA_E_0004<AAC>, Account 'testacct' on 'XXXXXXXXXX' creation failed: Connector Server Add failed: code 70 (RESULTS_TOO_LARGE): failed to add entry eTDYNAccountName=testacct,eTDYNAccountContainerName=Accounts,eTDYNDirectoryName=XXXXXXXXXX,eTNamespaceName=UNIX v2,dc=im,dc=etasa: JCS@XXXXXXXXXX: UNIX: Error after account creation JCS@XXXXXXXXXX: UNIX: Cannot perform the operation on [testacct]. The information returned by the endpoint is ['passwd: Invalid argument to option -n', 'Invalid combination of options', 'rc=2'].. (ldaps://XXXXXXXXXX:20411)
Release : 14.4
The problem is this combination of attributes:
eTDYN-str-multi-11(Minimum Before Change): 0
eTDYN-str-multi-12(Maximum Age of Password): -1
eTDYN-str-multi-13(Warning): 7
On Solaris we can use eTDYN-str-multi-12=-1 neither together with eTDYN-str-multi-11=0 nor together with eTDYN-str-multi-13=7
That's why Solaris returned "passwd: Invalid argument to option -n, Invalid combination of options" message
eTDYN-str-multi-11 is called "Minimum Before Change" in our Unix v2 metadata, and it corresponds to '-n' parameter of passwd command on Solaris
eTDYN-str-multi-12 "Maximum Age of Password": '-x' parameter
eTDYN-str-multi-13 "Warning": '-w' parameter
This is what passwd command man page on Solaris says:
-n min
Sets minimum field for name. The min field contains the minimum
number of days between password changes for name. If min is greater
than max, the user can not change the password. Always use this
option with the -x option, unless max is set to -1 (aging turned
off). In that case, min need not be set.
-w warn
Sets warn field for name. The warn field contains the number of
days before the password expires and the user is warned. This
option is not valid if password aging is disabled.
-x max
Sets maximum field for name. The max field contains the number of
days that the password is valid for name. The aging for name is
turned off immediately if max is set to -1.
So in order to set account password to never expired please use eTDYN-str-multi-12(Maximum Age of Password) = -1, and leave eTDYN-str-multi-11(Minimum Before Change) and eTDYN-str-multi-13(Warning) blank