On 03/25/2015 09:53 PM, Lukas Slebodnik wrote:
On (25/03/15 14:35), Pavel Reichl wrote:
>
> On 03/25/2015 02:21 PM, Lukas Slebodnik wrote:
>> On (25/03/15 14:05), Pavel Reichl wrote:
>>> On 03/25/2015 01:51 PM, Lukas Slebodnik wrote:
>>>> On (25/03/15 12:01), Pavel Reichl wrote:
>>>>> Hello please see attached patch.
>>>>>
>>>>> The need for this patch was discussed in thread: SDAP: Lock out ssh
keys when
>>>>> account naturally expires
>>>>> This patch implements point number 3.
>>>>>
>>>>>>> I would prefer if we didn't add a new option as well, but
since we
>>>>>>> released
>>>>>>> a version that only supported the lockout and not any other
semantics,
>>>>>>> I don't think we can get away with just changing the
functionality. A
>>>>>>> minor version can break functionality. But a major version
can
>>>>>>>
>>>>>>> So I propose the following:
>>>>>>> 1) Add a new value for ldap_access_order called
"ppolicy" that would
>>>>>>> evaluate the pwdAccountLockedTime fully, including the new
>>>>>>> functionality in this patchset
>>>>>>> 2) In 1.12, deprecate the "lockout" option and log
a warning that it
>>>>>>> will be removed in future relase and users should migrate to
"ppolicy"
>>>>>>> option
>>>> The feature was introduced in sssd-1.12.1 and deprecated in sssd-1.12.5
>>>> That's really fast progres. The deprecating the features
>>>> after half a year.
>>>>
>>>> Could someone exaplain me why do we need to do such ritual dances?
>>>>
>>>> LS
>>> First there was user ho wanted lockout functionality that is being dropped
>>> now.
https://fedorahosted.org/sssd/ticket/2364
>>>
>>> Then a few months later there came another user with
>>>
https://fedorahosted.org/sssd/ticket/2534 who wished to do something similar
>>> but different.
>>>
I checked bugzilla tickets and the same user requested both features.
But we
can't be sure there are other users using it, can we? IMO we
can't break their configuration at least not in minor release.
>>> We think that user case addressed in 1st ticket can be handled by
>>> functionality introduced for 2nd ticket.
>>>
>> I mentioned it as a part of review a month ago.
>> So you needn't explain it to me.
> I'm sorry then.
>>> So we decided to drop functionality for the first patch. Is it clear now?
>>>
>> The only think which I do not understand is why do we need to drop it know
>> and it could not be part of ticket #2534
> It is my understanding we could not drop the functionality in 1.12 - as there
> are users who use it - so we needed to keep both.
>
> But I think you are right that we could drop it in master as part of #2534.
> Might be you remember that we were on tight schedule then and we simply
> forget to this extra work for master.
> Now QE reminded us a created a BZ.
BZ1205604 says:
Expected results:
Only ppolicy works since it is stricter than lockout
So your patch is wrong and we need to drop functionality even in 1.12
You are
right, that there is a difference between BZ and what was
previously discussed and is implemented in the patch. I think it will be
for the best to discuss this on devel meeting.
NACK
LS
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel