IPA-EPN(1)

💌 NAME 💌

ipa-epn — bestie, it sends expiring password notifications. That's the whole vibe. It lives in the IPA Manual Pages, section 1, and it is so good at what it does. 🎀

---

✨ SYNOPSIS ✨

ipa-epn [options]

that's it. that's the whole thing. options only, no positional args, we love a low-maintenance queen 👑

---

🌸 DESCRIPTION 🌸

okay so ipa-epn gives you a whole method to warn users via email that their IPA account password is about to expire. like a little "hey bestie ur password is dying" note. 💅

it can be used in dry-run mode, which is recommended during setup — no cap, please do this first. the output is always JSON in this case. always. no exceptions. ✨

it can also be launched daily by its systemd timer. in that case it will parse its configuration file epn.conf(5) and send an email to users whose passwords are expiring within the defined future date ranges. 🦋

see the OPTIONS section below and the epn.conf(5) man page on how to configure the tool. iykyk 🫶

---

🎀 OPTIONS 🎀

• --to-nbdays <number of days> — the --to-nbdays CLI option can be used to determine the number of notifications that would be sent in a given timeframe. literally a headcount of emails. 😭

if --from-nbdays is not specified, ipa-epn will look within a 24-hour long time range in <number of days> days.

if --from-nbdays is specified, the date range starts at --from-nbdays days in the future and ends at --to-nbdays in the future.

together, these two CLI options can be used to determine how many emails would be sent in a specific time in the future. 🔮

⚠️ the --to-nbdays CLI option implies --dry-run. it's giving "surprise, you're in dry-run now". 💀

• --from-nbdays <number of days> — see --to-nbdays for an explanation. this option must be used in conjunction with --to-nbdays. they're a package deal, fr fr. 🫶
• --dry-run — the --dry-run CLI option is intended to test ipa-epn's configuration. a little rehearsal before the main character moment. 🌟

for instance, if notify_ttls is set to 21, 14, 3, --dry-run would display the list of users whose passwords would expire in 21, 14, and 3 days in the future. 📅

• --mail-test — the --mail-test CLI option will send an e-mail to the configured smtp_admin value in /etc/ipa/epn.conf. generic values for the substitution variables are set so this is also useful for testing and configuring the mail template. 🧚

---

🦋 TEMPLATE 🦋

the template for the e-mail message is contained in /etc/ipa/epn/expire_msg.template. the following template variables are available. ✨

• user ID: uid
• full name: fullname
• first name: first
• last name: Last
• password expiration date: expiration

---

🔥 EXAMPLES 🔥

# date
Sun 12 Apr 2020 06:23:08 AM CEST
# ipa-epn --dry-run
[
   {
      "uid": "user5",
      "cn": "user 5",
      "krbpasswordexpiration": "2020-04-17 15:51:53",
      "mail": "['user5@ipa.test']"
   }
]
The IPA-EPN command was successful

# ipa-epn --to-nbdays 6 --dry-run
[
   {
      "uid": "user5",
      "cn": "user 5",
      "krbpasswordexpiration": "2020-04-17 15:51:53",
      "mail": "['user5@ipa.test']"
   }
]
The IPA-EPN command was successful

# ipa-epn --from-nbdays 2 --to-nbdays 6 --dry-run
[
   {
      "uid": "user5",
      "cn": "user 5",
      "krbpasswordexpiration": "2020-04-17 15:51:53",
      "mail": "['user5@ipa.test']"
   }
]
The IPA-EPN command was successful

# ipa-epn --from-nbdays 8 --to-nbdays 12 --dry-run
[
   {
      "uid": "user3",
      "cn": "user 5",
      "krbpasswordexpiration": "2020-04-21 00:00:08",
      "mail": "['user3@ipa.test']"
   }
]
The IPA-EPN command was successful

look at that JSON output go. The IPA-EPN command was successful is genuinely my roman empire 💜

---

💅 EXIT STATUS 💅

the exit status is 0 on success, nonzero on error. simple as that, bestie. 🍓

---

🌈 SEE ALSO 🌈

• RFE: https://pagure.io/freeipa/issue/3687
• Design document: https://github.com/freeipa/freeipa/blob/master/doc/designs/expiring-password-notification.md

---

🙈 KNOWN BUGS 🙈

none yet. a flawless queen with a clean record, periodt. ✨

---

⭐ REPORTING BUGS AND ENHANCEMENT IDEAS ⭐

please make sure first the issue is not already reported by searching at https://pagure.io/freeipa/issues. if it is not, file a new issue at https://pagure.io/freeipa/new_issue.

💖 seriously, search first. we don't do duplicate issues here, it's not the vibe. 🙏

---

okay that's the whole page!! this is IPA (source), dated April 24, 2020, and it's the IPA-EPN(1) manual page — thanks for reading all the way to the end bestie, ur the realest 🫶✨💅