please see attached patches.
Does it make sense to check on cases when pwdAccountLockedTime is some
future time event?
If agreed to I'll send patch adding test for new utility function
the first patch add support for subdomains, which was missing in current
implementation. It probably wasn't a big deal with netgroups but I think
it would be with users and groups.
The majority of these patches refactors the current be_refresh to make
support of other object types than netgroups a lot easier and
this patch should fix the following compiler warning:
../src/providers/ldap/ldap_child.c: In Funktion »main«:
../src/providers/ldap/ldap_child.c:503:160: Warnung: »ccname_file_dummy«
könnte in dieser Funktion uninitialisiert verwendet werden
DEBUG(SSSDBG_TRACE_INTERNAL, "Unlinking [%s]\n",
»ccname_file_dummy« wurde hier deklariert
I'm still working on the SELinux provider unit tests, but mocking the
interfaces it uses turned out to be more work than I anticipated, so I'm
sending the patch without a test for now and will send the test
If there is an error after ccname_file_dummy is created but before it is
renamed then the file isn't removed. This can cause a lot of files to
be created and take up inodes in a filesystem.
please see attached patches resolving
1st patch contains some minor refactoring useful for 2nd patch.
How to test:
On OpenLDAP following attributes should be set:
* shadowMax - how many days after shadowLastChange will password expire
* shadowWarning - how many days before password expires should warning
In sssd.conf domain section should contain something similar to:
access_provider = ldap
ldap_access_order = expire, expire_policy
ldap_account_expire_policy = shadow
ldap_pwd_policy = shadow