UCS 2.4 - Univention

4 Univention Directory Manager
56
The following interconnections between the different login methods are derived from the UCS PAM
configuration:
• The Linux login (e.g., on GDM or a tty) is only deactivated if all login methods are deactivated;
a deactivated POSIX account alone is not enough.
• Samba requires a not-deactivated POSIX account - that means that the deactivation of the
POSIX account automatically deactivates Samba as well.
• The Kerberos library (Heimdal) also evaluates the Samba account settings - that means that
the deactivation of the Windows account will also deactivate Kerberos.
Change password on next login
If this checkbox is ticked, then the user has to change his password during the next login procedure.
If the option is activated, the present date will be used as the expiry date for the current password.
Further details can be found in the description Expiry Date on the same tab.
Locked login methods
This selection field can be used to block individual login methods. This can happen automatically
for security reasons, for example, if a user has entered his password incorrectly too often. Normally
users should always be blocked for all login methods.
In contrast to Account deactivation, the account is not blocked, but the login is denied. The following
login methods can be restricted:
• None
• Locked all login methods
• Locked Windows/Kerberos only
• Locked POSIX/LDAP only
’Mail’ tab
Primary e-mail address
The primary e-mail address of the user is declared here. E-mail addresses can consist of the following
characters: letters a-z, numerals 0-9, dots, hyphens, and underlines. The address has to begin with
a letter and must include an @ character.
Alternative e-mail addresses
Further e-mail addresses can be declared here for the user. E-mails to these addresses will be
delivered to the same inbox as mails sent to the user’s primary e-mail address. It is possible for
several users to use the same alternative e-mail address. However the multi-used alternative e-mail
address should not be used as the primary e-mail address by one of the users.