userPassword -> user password
shadowLastChange -> days since Jan 1, 1970 that password was last changed
shadowMin -> Days before password may be changed
shadowMax -> Days after which password must be changed
shadowWarning -> Days before password is to expire that user is warned
shadowInactive -> Days after password expires that account is disabled
shadowExpire -> Days since Jan 1, 1970 that account is disabled
shadowFlag -> a reserved field

la cuenta es desactivada si hoy >= shadowExpire
o si hoy >= shadowlastchange + shadowmax + shadowinactive

group members: memberUid (member uid) or uniqueMember (full DN)