The password policy has been used in OpenLDAP for more than 25 years. It has evolved a lot, in order to adapt to new usage, good practice, security issues, and performance needs.

The presentation will present multiple topics:

- summarize the current specification,

- describe the OpenLDAP password policy implementation

- show a concrete state of the art use case of Password Policy, as deployed in a customer environment

- describe the last password policy features in 2.5, 2.6, 2.7

- introduce the ppm extension

As a conclusion, I'll propose a whishlist of password policy needs that are often asked: account disabling, entropy,... and discuss how to implement them.