On 03/25/2015 12:01 PM, Pavel Reichl wrote:
Hello please see attached patch.
The need for this patch was discussed in thread: SDAP: Lock out ssh
keys when account naturally expires
This patch implements point number 3.
>> I would prefer if we didn't add a new option as well, but since we
>> released
>> a version that only supported the lockout and not any other semantics,
>> I don't think we can get away with just changing the functionality. A
>> minor version can break functionality. But a major version can
>>
>> So I propose the following:
>> 1) Add a new value for ldap_access_order called "ppolicy" that would
>> evaluate the pwdAccountLockedTime fully, including the new
>> functionality in this patchset
>> 2) In 1.12, deprecate the "lockout" option and log a warning that it
>> will be removed in future relase and users should migrate to "ppolicy"
>> option
>> 3) In master (1.13), remove the "lockout" ldap_access_order value
Thanks!
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel Hello,
I think that it was decided that we won't push these patches. So unless
there are any more comments, please consider this thread to be closed.
Thanks!