From jhrozek at redhat.com Thu Aug 20 12:59:03 2015 Content-Type: multipart/mixed; boundary="===============1349904932595402630==" MIME-Version: 1.0 From: Jakub Hrozek To: sssd-devel at lists.fedorahosted.org Subject: Re: [SSSD] Here is a patch for sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout' Date: Wed, 22 Oct 2014 16:26:47 +0200 Message-ID: <20141022142647.GZ10559@hendrix.redhat.com> In-Reply-To: CAMU=ENcjThB6TsWt79AjSgpfb-utY8PgrPSteZeu69dQsJJKQA@mail.gmail.com --===============1349904932595402630== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Wed, Oct 15, 2014 at 09:30:50AM -0400, Dan Lavu wrote: > Here you go, sorry for all the little errors, I'm still new to this. Sorry for the delay in the review.. ACK! > = > On Tue, Oct 14, 2014 at 8:38 AM, Jakub Hrozek wrot= e: > = > > On Mon, Oct 13, 2014 at 03:36:54PM -0400, Dan Lavu wrote: > > > I had a merge issue, so I just redid the patch (with some minor chang= es) > > after a rebase, so it should be good now? > > > > There are two typos, see inline. After fixing these, I'll ACK :-) > > > > > From 61b96bb58b0a6e078708c45794c1067d1be2d133 Mon Sep 17 00:00:00 2001 > > > From: Dan Lavu > > > Date: Mon, 13 Oct 2014 15:06:53 -0400 > > > Subject: [PATCH] MAN PAGE: modified sssd-ldap.5.xml for sssd ticket #= 2451 > > > > > > Added a configuration example at the bottom for > > > 'ldap_access_order =3D lockout'. Also added a line > > > to note that 'ldap_access_provider =3D ldap' must > > > be specified for this feature to work. > > > --- > > > src/man/sssd-ldap.5.xml | 26 +++++++++++++++++++++++++- > > > 1 file changed, 25 insertions(+), 1 deletion(-) > > > > > > diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml > > > index > > 03ea7948b69ed28945fc614eee5c47195cd85937..b5e971fd036cbb0e89b821b267551= 196edfcd4e7 > > 100644 > > > --- a/src/man/sssd-ldap.5.xml > > > +++ b/src/man/sssd-ldap.5.xml > > > @@ -1921,7 +1921,10 @@ ldap_access_filter =3D (employeeType=3Dadmin) > > > If set, this option denies access in case > > that ldap > > > attribute 'pwdAccountLockedTime' is pres= ent > > and has > > > value of '000001010000Z'. Please see the > > option > > > - ldap_pwdlockout_dn. > > > + ldap_pwdlockout_dn. > > > + > > > + Please note that 'ldap_access_provider = =3D > > ldap' must > > > > The option is called just 'access_provider', not 'ldap_access_provider'. > > > > > + be set for this feature to work. > > > > > > > > > expire: use > > > @@ -2491,6 +2494,27 @@ ldap_access_filter =3D (employeeType=3Dadmin) > > > > > > > > > > > > + > > > + LDAP ACCESS FILTER EXAMPLE > > > + > > > + The following example assumes that SSSD is correctly > > > + configured and to use the ldap_access_order=3Dlockout. > > > + > > > + > > > + > > > + [domain/LDAP] > > > + id_provider =3D ldap > > > + auth_provider =3D ldap > > > + access_provider =3D ldap > > > + ldap_Access_order =3D lockout > > > > The options in SSSD are all lowercased, so this one should read: > > ldap_access_order > > > > > + ldap_pwdlockout_dn =3D cn=3Dppolicy,ou=3Dpolicies,dc=3Dmydomain,= dc=3Dorg > > > + ldap_uri =3D ldap://ldap.mydomain.org > > > + ldap_search_base =3D dc=3Dmydomain,dc=3Dorg > > > + ldap_tls_reqcert =3D demand > > > + cache_credentials =3D true > > > + > > > + > > > + > > > > > > > > > NOTES > > > -- > > > 1.9.3 > > > _______________________________________________ > > > sssd-devel mailing list > > > sssd-devel(a)lists.fedorahosted.org > > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > > > > _______________________________________________ > > sssd-devel mailing list > > sssd-devel(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > > > From 1c629f2da937be8bba111e76bfd10626fe0c86c0 Mon Sep 17 00:00:00 2001 > From: Dan Lavu > Date: Mon, 13 Oct 2014 15:06:53 -0400 > Subject: [PATCH] MAN PAGE: modified sssd-ldap.5.xml for sssd ticket #2451 > = > Added a configuration example at the bottom for > 'ldap_access_order =3D lockout'. Also added a line > to note that 'ldap_access_provider =3D ldap' must > be specified for this feature to work. > --- > src/man/sssd-ldap.5.xml | 26 +++++++++++++++++++++++++- > 1 file changed, 25 insertions(+), 1 deletion(-) > = > diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml > index 03ea7948b69ed28945fc614eee5c47195cd85937..3f7d07a8cf668eb54bfc10139= 813d09f1cc61e11 100644 > --- a/src/man/sssd-ldap.5.xml > +++ b/src/man/sssd-ldap.5.xml > @@ -1449,7 +1449,7 @@ > > > Specifies acceptable cipher suites. Typical= ly this > - is a colon sperated list. See = > + is a colon sperated list. See > ldap.conf > 5 for = format. > > @@ -1922,6 +1922,9 @@ ldap_access_filter =3D (employeeType=3Dadmin) > attribute 'pwdAccountLockedTime' is present = and has > value of '000001010000Z'. Please see the opt= ion > ldap_pwdlockout_dn. > + > + Please note that 'access_provider =3D ldap' = must > + be set for this feature to work. > > > expire: use > @@ -2491,6 +2494,27 @@ ldap_access_filter =3D (employeeType=3Dadmin) > > > > + > + LDAP ACCESS FILTER EXAMPLE > + > + The following example assumes that SSSD is correctly > + configured and to use the ldap_access_order=3Dlockout. > + > + > + > + [domain/LDAP] > + id_provider =3D ldap > + auth_provider =3D ldap > + access_provider =3D ldap > + ldap_access_order =3D lockout > + ldap_pwdlockout_dn =3D cn=3Dppolicy,ou=3Dpolicies,dc=3Dmydomain,dc= =3Dorg > + ldap_uri =3D ldap://ldap.mydomain.org > + ldap_search_base =3D dc=3Dmydomain,dc=3Dorg > + ldap_tls_reqcert =3D demand > + cache_credentials =3D true > + > + > + > = > > NOTES > -- = > 1.9.3 > = > _______________________________________________ > sssd-devel mailing list > sssd-devel(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel --===============1349904932595402630==--