Marcello,

I did run a quick test on the global password policy and noticed that the "Max lifetime" seemed to take affect immediately for individual users:

# ipa pwpolicy-mod global_policy --maxlife 99999

Group: global_policy

Max lifetime (days): 99999

Min lifetime (hours): 1

History size: 0

Character classes: 0

Min length: 8

Max failures: 6

Failure reset interval: 60

Lockout duration: 600

# ipa pwpolicy-show --user=chris

Group: global_policy

Max lifetime (days): 99999

Min lifetime (hours): 1

History size: 0

Character classes: 0

Min length: 8

Max failures: 6

Failure reset interval: 60

Lockout duration: 600

Are you seeing different behavior?

-Chris

_{>>  do I have to reset the user password everytime I change the value of the Max Lifetime field?}

_{The max age is calculated based on the policy applicable to user when he changes the password (and it's stored in krbPasswordExpiration), changing the policy wont change the krbPasswordExpiration value that already exists, so you have to,}

_{1. let users change password, so they'll have the updated Max life time for their password.}

_or

_{Update 'krbPasswordExpiration' attribute for the users manually.}

_{For example:}

_{# ldapmodify -x -D cn="Directory Manager" -w <DMs passwd>}

_{dn: uid=ipa-ldap1,cn=users,cn=accounts,dc=gsslab,dc=pnq,dc=redhat,dc=com}

_{changetype: modify}

_{replace: krbpasswordexpiration}

_{krbpasswordexpiration: 20150205082946Z}

_{modifying entry "uid=ipa-ldap1,cn=users,cn=accounts,dc=gsslab,dc=pnq,dc=redhat,dc=com"}

_{You have to run the above (script it, or pre-create an ldif with necessary contents) for all users.}