Title: #269: Add support for ActiveDirectory's logonHours restrictions
This is a straightforward patch for denying access to a user when the user is not
permitted to access their account due to logonHours restrictions.
This matches the default behaviour for domain-joined Windows machines. When outside the
logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it
is appropriate to put this check inside the PAM "account" rules.
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/269/head:pr269
git checkout pr269