Chapter 9. Authentication in ThinLinc
asks if the password should be changed now, or not.
• If the password has expired, and "grace logins" are enabled, tl-nds-check-expired will pop up a
window and tell the user how many logins he/she has left before the account will be locked. The user
will again be asked if he/she wants to change the password.
• If the number of "grace logins" left is less than 3, the pop up window will inform the user that the
current login attempt is the last login attempt before the account will be locked, and ask if the user
wants to change password.
• If the account is locked, the ThinLinc client will say that the username or password was invalid. No
session will be created.
9.3.5.2. Configuration
Before trying to use tl-nds-check-expired, make sure that tl-passwd works, since it’s used by
tl-nds-check-expired. Pay special attention to the note about pam_password in the part about the
tl-passwd in Chapter 13 to make sure it’s set to a value appropriate for the eDirectory environment.
tl-nds-check-expired has one parameter, /utils/tl-nds-check-expired/warning_days, in the
file tl-nds-check-expired.hconf located among the rest of the ThinLinc configuration files on the
server. The warning_days parameter decides how many days before the password for a specific user
expires that tl-nds-check-expired begins to warn about the expire date. If set to 0, it will not warn until
the password actually has expired.
9.3.5.3. How to Activate Force Password Changes
Start by verifying that the search DN created and configured either via the ThinLinc Novell Configurator
(TLNC) (see Section 9.3.1) or via the procedure described in Section C.5 has access to the attributes
passwordExpirationTime, loginGraceRemaining, and loginGraceLimit. Then create a symbolic link in
/opt/thinlinc/etc/xstartup.d pointing at the tl-nds-check-expired command:
ln -s /opt/thinlinc/bin/tl-nds-check-expired /opt/thinlinc/etc/xstartup.d/08-tl-nds-check-expired
Now continue by testing to login as a user with a password that will soon expire, or a password that has
expired and has grace login attempts left.
9.3.5.4. Interaction with Application Servers and Fat Clients
IMPORTANT: Due to the internal structure of ThinLinc, each time a user logs in, two separate
authentications are performed. This means that if "grace logins" are enabled, each time a user logs in
after the password expiration time, two grace login attempts are consumed. The number of grace logins
available should be adjusted to compensate for this. Grace login attempts are also consumed at session
startup, if any NCP resources are mounted.
Also, if a user uses both ThinLinc and fat workstations, another problem might occur. If the user has
logged in to fat workstations and ignored the prompt for password change so that the number of grace
logins left is 1 or 2, the user will be locked out the next time he/she tries to login to ThinLinc, since the
ThinLinc session will only be setup halfway before the server refuses to authenticate the user.
100
Komentáře k této Příručce