>From b4d21bfae0fe194c05c25a699a15ba046b656e2d Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 16 Mar 2015 11:28:25 +0100 Subject: [PATCH 4/5] IPA: Deprecate the ipa_hbac_treat_deny_as option https://fedorahosted.org/sssd/ticket/2603 Deny rules have not been supported by the IPA server since 2.1. We should deprecate the ipa_hbac_treat_deny_as option. --- src/providers/ipa/ipa_access.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c index 2ebaec337eedd205bab7c7cbb2a77568616062d0..d1ae18999d0b1c7637ab6de52b0290cde1c40e87 100644 --- a/src/providers/ipa/ipa_access.c +++ b/src/providers/ipa/ipa_access.c @@ -178,6 +178,10 @@ static void ipa_hbac_check(struct tevent_req *req) hbac_ctx->get_deny_rules = false; } else { hbac_ctx->get_deny_rules = true; + sss_log(SSS_LOG_NOTICE, + "WARNING: Using deny rules is deprecated, the option " + "ipa_hbac_treat_deny_as will be removed in the next " + "upstream version\n"); } ret = hbac_retry(hbac_ctx); -- 2.1.0