NOTE: The original article was posted by and the included images were lost in following years. This posting has been updated by to replace missing images and provide the XML examples. These images and code examples hold true to mbluteau's original though with some personal differences.

We basically want to take advantage of 2 attributes, Login Time (which contains the last login time for the user) and Login Expiration Time, which prevent a user from login in once reached.

We want to monitor Login Time, and every time it changes, update Login Expiration Time by setting it to Login Time 1 year (or 31,536,000 seconds).

Figure 1: We need to open up the filter for the Null/Loopback driver for Login Time.

<filter> <filter-class class-name="User" publisher="ignore" publisher-create-homedir="true" publisher-track-template-member="true" subscriber="sync"> <filter-attr attr-name="Login Time" merge-authority="default" publisher="ignore" publisher-optimize-modify="true" subscriber="sync"/> </filter-class> </filter>

Figure 2: Filter details for Login Time.

Figure 3: Simple rule to update Login Expiration time, using a GCV and XPath.

<policy> <rule> <description>Set Account to Disable 1yr After Last Login</description> <comment xml:space="preserve">Set the Login Expiration time to be one year after the current login time. Uses a GCV value representing 1 year in seconds.</comment> <conditions> <and> <if-class-name mode="nocase" op="equal">User</if-class-name> <if-op-attr name="Login Time" op="available"/> </and> </conditions> <actions> <do-set-local-variable name="lv-loginTime" scope="policy"> <arg-string> <token-op-attr name="Login Time"/> </arg-string> </do-set-local-variable> <do-set-src-attr-value class-name="User" name="Login Expiration Time"> <arg-value type="string"> <token-xpath expression="$lv-loginTime ~gv-1yrSeconds~"/> </arg-value> </do-set-src-attr-value> </actions> </rule> </policy>

Figure 4: Rule details to update Login Expiration time, using a GCV and XPATH.

Beware that you may want to restrict the Rule scope to non-admin users.