On 05/11/2015 07:28 PM, Jakub Hrozek wrote:
On Mon, May 11, 2015 at 02:35:35PM +0200, Pavel Reichl wrote:
> On 05/11/2015 12:24 PM, Jakub Hrozek wrote:
>> On Wed, Mar 25, 2015 at 10:19:39AM +0100, Pavel Reichl wrote:
>>> Hello,
>>>
>>> attached patch deprecates lockout option in 1-12 branch.
>>>
>>> This was discussed in thread: SDAP: Lock out ssh keys when account naturally
expires
>>> This patch implements point number 2.
>>>
>>>>> I would prefer if we didn't add a new option as well, but since
we released
>>>>> a version that only supported the lockout and not any other
semantics,
>>>>> I don't think we can get away with just changing the
functionality. A
>>>>> minor version can break functionality. But a major version can
>>>>>
>>>>> So I propose the following:
>>>>> 1) Add a new value for ldap_access_order called "ppolicy"
that would
>>>>> evaluate the pwdAccountLockedTime fully, including the new
>>>>> functionality in this patchset
>>>>> 2) In 1.12, deprecate the "lockout" option and log a
warning that it
>>>>> will be removed in future relase and users should migrate to
"ppolicy"
>>>>> option
>>>>> 3) In master (1.13), remove the "lockout" ldap_access_order
value
>>> I'll send patch for point number 3 in separate thread.
>>>
>>> Thanks!
>> I'm sorry it took so long to get back to this patch.
>>
>>> From 3adee0c2ff207eef7c2edcfed80eb47754570210 Mon Sep 17 00:00:00 2001
>>> From: Pavel Reichl <preichl(a)redhat.com>
>>> Date: Wed, 25 Mar 2015 05:03:12 -0400
>>> Subject: [PATCH] LDAP: warn about lockout option being deprecated
>>>
>>> ---
>>> src/man/sssd-ldap.5.xml | 7 +++++++
>>> src/providers/ldap/sdap_access.c | 9 ++++++++-
>>> 2 files changed, 15 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
>>> index
00da3964af7619f19525e76c4f1292586dd60f54..b46e07fec96ffa7305ab41ce42c16b2e94e53292 100644
>>> --- a/src/man/sssd-ldap.5.xml
>>> +++ b/src/man/sssd-ldap.5.xml
>>> @@ -1955,6 +1955,13 @@ ldap_access_filter = (employeeType=admin)
>>> be set for this feature to work.
>>> </para>
>>> <para>
>>> + <emphasis>
>>> + Please note that this option is superseded by
>>> + ppolicy option and will be dropped in next
major
>>> + release.
>> Since we can't remove the option soon, I'd say "might be removed in
a
>> future release". It would also be nice to point the admin to the option
>> he should be using now instead.
> OK, I mentioned ppolicy option for the second time, or did you just want me
> to rephrase the sentence?
Ah, sorry, no. I was reading the rendered text and didn't realize
ppolicy was an option and not a generic term. Sorry, can you remove the
added sentence adn then just enclose ppolicy in <quote> ? That would
make the rendering better readable I guess. Also, "the ppolicy option".
OK, please see updated patch.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel