>From 4560b5d52e2c816df7b6479908a63cad6bbb8622 Mon Sep 17 00:00:00 2001
From: Pavel Reichl <preichl@redhat.com>
Date: Mon, 19 Jan 2015 03:24:09 -0500
Subject: [PATCH 1/3] SDAP: new option - pwdlocking natural/only by admin

This is a follow up to #2364.
To distinguish user locked out from accessing machine via SSH if an
account was administratively locked (pwdAccountLockedTime set to
000001010000Z) in the OpenLDAP Password Policy overlay or if user
password is locked out from natural reasons (too many attempts, expired
password).

Part of solution for:
https://fedorahosted.org/sssd/ticket/2534
---
 src/config/SSSDConfig/__init__.py.in     |  1 +
 src/config/etc/sssd.api.d/sssd-ad.conf   |  1 +
 src/config/etc/sssd.api.d/sssd-ipa.conf  |  1 +
 src/config/etc/sssd.api.d/sssd-ldap.conf |  1 +
 src/man/sssd-ldap.5.xml                  | 31 +++++++++++++++++++++++++++++++
 src/providers/ad/ad_opts.h               |  1 +
 src/providers/ipa/ipa_opts.h             |  1 +
 src/providers/ldap/ldap_opts.h           |  1 +
 src/providers/ldap/sdap.h                |  1 +
 9 files changed, 39 insertions(+)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index 500bd717fec7abcaafd5153ccca7847b91e208ad..90d5aa2d49454e6f8664349fe3fe3d22943dd037 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -344,6 +344,7 @@ option_strings = {
     'ldap_min_id' : _('Set lower boundary for allowed IDs from the LDAP server'),
     'ldap_max_id' : _('Set upper boundary for allowed IDs from the LDAP server'),
     'ldap_pwdlockout_dn' : _('DN for ppolicy queries'),
+    'ldap_pwdlockout_admin_locked_only' : _('Account is locked only if administrator sets specific value (000001010000Z)'),
 
     # [provider/ldap/auth]
     'ldap_pwd_policy' : _('Policy to evaluate the password expiration'),
diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf
index 3496fb4006697d380f7c9729ed9997272cbce2ea..714ff5ab03601cf73b0356ab9a58a3a2af234d75 100644
--- a/src/config/etc/sssd.api.d/sssd-ad.conf
+++ b/src/config/etc/sssd.api.d/sssd-ad.conf
@@ -124,6 +124,7 @@ ldap_initgroups_use_matching_rule_in_chain = bool, None, false
 ldap_use_tokengroups = bool, None, false
 ldap_rfc2307_fallback_to_local_users = bool, None, false
 ldap_pwdlockout_dn = str, None, false
+ldap_pwdlockout_admin_locked_only = bool, None, false
 
 [provider/ad/auth]
 krb5_ccachedir = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index 2a3b7ef1519e3476cb4b432336da0c359b1844ba..c02e6f0ba8eeaed322939653658bb43719d67474 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -134,6 +134,7 @@ ldap_use_tokengroups = bool, None, false
 ldap_rfc2307_fallback_to_local_users = bool, None, false
 ipa_server_mode = bool, None, false
 ldap_pwdlockout_dn = str, None, false
+ldap_pwdlockout_admin_locked_only = bool, None, false
 ipa_views_search_base = str, None, false
 ipa_view_class = str, None, false
 ipa_view_name = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index ba5f56f1942da552fc6ab8f82851714756683a8f..4beb50fc8cbeea18ce6948bfa0a72da650fbb934 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -122,6 +122,7 @@ ldap_rfc2307_fallback_to_local_users = bool, None, false
 ldap_min_id = int, None, false
 ldap_max_id = int, None, false
 ldap_pwdlockout_dn = str, None, false
+ldap_pwdlockout_admin_locked_only = bool, None, false
 
 [provider/ldap/auth]
 ldap_pwd_policy = str, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 9f2e9ac34add13e40d316374094024afdcc4ae31..3e6520995fb4af4e1b9eca7a4535616b2e1ccef6 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1998,6 +1998,37 @@ ldap_access_filter = (employeeType=admin)
                 </varlistentry>
 
                 <varlistentry>
+                    <term>ldap_pwdlockout_admin_locked_only (string)</term>
+                    <listitem>
+                        <para>
+                          If set to true then account is considered locked only if
+                          attribute pwdAccountLockedTime is equal to
+                          000001010000Z.
+                          Otherwise account is considered locked if:
+                          <itemizedlist>
+                              <listitem>
+                                  <para>
+                                    value of pwdAccountLockedTime is time event
+                                    in past
+                                  </para>
+                              </listitem>
+                              <listitem>
+                                  <para>
+                                    and if pwdLockoutDuration attribute is
+                                    present and is not equal to zero then
+                                    (pwdAccountLockedTime + pwdLockoutDuration)
+                                    is time event in future.
+                                  </para>
+                              </listitem>
+                          </itemizedlist>
+                        </para>
+                        <para>
+                          Default: true
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
                     <term>ldap_deref (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index d9405e5020ca724a0f7caa752ac10fb07d8aa397..87f3e5d10817923123c5f51425cc5ddeb930f28d 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -144,6 +144,7 @@ struct dp_option ad_def_ldap_opts[] = {
     { "ldap_min_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
     { "ldap_max_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
     { "ldap_pwdlockout_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_pwdlockout_admin_locked_only", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index 66af648583e552d7edd932f6bb5a2c3bef107e51..59a4bcba4b8afd1194a0f16a28c14473364253d1 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -158,6 +158,7 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_min_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
     { "ldap_max_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
     { "ldap_pwdlockout_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_pwdlockout_admin_locked_only", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index 7c9ed3e01f726f2ba6ecb2a7268867abd3baa37d..a3307305cbeeb2c13a2b8ac44c54e5c56ff2893b 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -122,6 +122,7 @@ struct dp_option default_basic_opts[] = {
     { "ldap_min_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
     { "ldap_max_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
     { "ldap_pwdlockout_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_pwdlockout_admin_locked_only", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 921051b41a911a2d1117672a8e9c2697b679f24e..20020a62f288fcf3bd9f8f9060cdcfc3b3043a47 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -231,6 +231,7 @@ enum sdap_basic_opt {
     SDAP_MIN_ID,
     SDAP_MAX_ID,
     SDAP_PWDLOCKOUT_DN,
+    SDAP_PWDLOCKOUT_ADMIN_LOCKED_ONLY,
 
     SDAP_OPTS_BASIC /* opts counter */
 };
-- 
2.1.0

