Title: #269: Add support for ActiveDirectory's logonHours restrictions
Thank you very much for the patch.
I have some suggestions:
1) I would actually suggest to take a look at samba's `logon_hours_ok` function. I
haven't checked carefully if the two make any difference function-wise, but my first
instinct would be to reuse what other projects already have rather than implementing the
functionality from scratch.
2) Even though on general it makes sense to behave as Windows clients do, at least with my
RHEL maintainer hat on, I'm not thrilled about adding another login restriction by
default. This could bite environments where the logonHours are set, but the admins rely on
Linux clients not "seeing" the attribute during upgrade to a new version. So I
would suggest to make the new attribute evaluation configurable during configure time -- I
guess if the option value was not set, we would just skip this check and the configure
time option would just set the correct attribute value so that the option would be
See the full comment at https://github.com/SSSD/sssd/pull/269#issuecomment-301736959