19.5. Changing the Priority of Group Password Policies

A user may belong to multiple groups, each with different password policies. Since only one policy can be in effect for a user, there has to be a method to assign precedence to policies. That is done through priority.

The highest priority is zero (0). The lower the number, the higher the priority.

This is set initially when the password policy is created. It can be modified after the policy is created by resetting the --priority option.

kinit admin
ipa pwpolicy-mod examplegroup --priority=10

[root@server ~]# kinit admin
[root@server ~]# ipa pwpolicy-mod examplegroup --priority=10

When a user belongs to multiple groups, the group password policy with the lowest priority number has the highest priority.