On 03/25/2015 02:21 PM, Lukas Slebodnik wrote:
On (25/03/15 14:05), Pavel Reichl wrote:
>
> On 03/25/2015 01:51 PM, Lukas Slebodnik wrote:
>> On (25/03/15 12:01), Pavel Reichl wrote:
>>> Hello please see attached patch.
>>>
>>> The need for this patch was discussed in thread: SDAP: Lock out ssh keys
when
>>> account naturally expires
>>> This patch implements point number 3.
>>>
>>>>> I would prefer if we didn't add a new option as well, but since
we
>>>>> released
>>>>> a version that only supported the lockout and not any other
semantics,
>>>>> I don't think we can get away with just changing the
functionality. A
>>>>> minor version can break functionality. But a major version can
>>>>>
>>>>> So I propose the following:
>>>>> 1) Add a new value for ldap_access_order called "ppolicy"
that would
>>>>> evaluate the pwdAccountLockedTime fully, including the new
>>>>> functionality in this patchset
>>>>> 2) In 1.12, deprecate the "lockout" option and log a
warning that it
>>>>> will be removed in future relase and users should migrate to
"ppolicy"
>>>>> option
>> The feature was introduced in sssd-1.12.1 and deprecated in sssd-1.12.5
>> That's really fast progres. The deprecating the features
>> after half a year.
>>
>> Could someone exaplain me why do we need to do such ritual dances?
>>
>> LS
> First there was user ho wanted lockout functionality that is being dropped
> now.
https://fedorahosted.org/sssd/ticket/2364
>
> Then a few months later there came another user with
>
https://fedorahosted.org/sssd/ticket/2534 who wished to do something similar
> but different.
>
> We think that user case addressed in 1st ticket can be handled by
> functionality introduced for 2nd ticket.
>
I mentioned it as a part of review a month ago.
So you needn't explain it to me.
I'm sorry then.
> So we decided to drop functionality for the first patch. Is it clear now?
>
The only think which I do not understand is why do we need to drop it know
and it could not be part of ticket #2534
It is my understanding we could not drop
the functionality in 1.12 - as
there are users who use it - so we needed to keep both.
But I think you are right that we could drop it in master as part of
#2534. Might be you remember that we were on tight schedule then and we
simply forget to this extra work for master.
Now QE reminded us a created a BZ.
LS
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel