title: Testing user password expiration with openldap
body: <p>I need to test whether our application can handle a user needing to change their password. I'm using the Docker openldap server available from here: <a href="https://github.com/osixia/docker-openldap" rel="nofollow noreferrer">https://github.com/osixia/docker-openldap</a>. </p>
  
  <p>I've added various things from here <a href="https://ldapwiki.com/wiki/Password%20MUST%20Change" rel="nofollow noreferrer">https://ldapwiki.com/wiki/Password%20MUST%20Change</a> to my schema, however if I try to add pwdMustChange to a user, Apache Directory Studio will fail saying the schema doesn't allow for it. </p>
  
  <p>This is what I've put in my schema:</p>
  
  <pre><code>attributetype ( PwdMustChange
  NAME 'PwdMustChange'
  DESC 'Password Must Be Changed'
  EQUALITY booleanMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
  )
  </code></pre>
  
  <p>Apache Directory Studio recognises the value as it autofills pwdMustChange, but when I try to enter a value in the above error occurs.</p>
  
  <p>My question boils down to: How can I simulate a user password expiration with openldap?</p>