URL:
https://github.com/SSSD/sssd/pull/269
Title: #269: Add support for ActiveDirectory's logonHours restrictions
jhrozek commented:
"""
First, I'm sorry this PR stalled for several months.
I finally had some time to re-check it and the primary thing I would suggest here is to
not add the code into the generic LDAP expiration code. I think it belongs more to the
`ad_access.c` module, because in general I would prefer to not add more AD-specific access
controls into the generic LDAP module and also because IPA has been planning for a long
time to add a time-based host access control policy and I think in IPA environments with
AD trusted users, the AD logon hours policy should not be evaluated.
So here's what I would propose to do:
- move the evaluation function to the `ad_acess.c` module
- unset the LDAP attribute mappings for IPA and LDAP case
- add a configure option which would be disabled for now, but enabled in a future release
that would enable this functionality for the AD provider. (note: Do we need a runtime
switch like we have for GPOs here as well?)
"""
See the full comment at
https://github.com/SSSD/sssd/pull/269#issuecomment-327159735