Title: #269: Add support for ActiveDirectory's logonHours restrictions
Thanks, I'll look into those things.
1. Regarding samba's `logon_hours_ok` - it's a static function, so we can't
call it directly. It's pretty-much identical to the short method I've written in
this PR, only they've added a little bit more debug-level logging. The only way to
re-use their method would be to call their `authsam_account_ok` which does quite a bit of
other stuff, some of it samba-specific I think. I don't really know the samba
codebase, and how much benefit their is to trying to share this bit of functionality. sssd
includes its own framework for querying and caching account records, so it's not going
to fit in very well.
2. Would it be better to have a runtime switch, rather than a compile-time switch? If RHEL
is going to compile this feature out, there's not much benefit to adding it (since our
customers will be using stock RHEL). If it were a runtime parameter, it could default to
'on' with a Release Note explaining to customers they can turn it off if they
See the full comment at https://github.com/SSSD/sssd/pull/269#issuecomment-301754453