On Mon, Aug 11, 2014 at 04:19:22PM +0200, Pavel Reichl wrote:
>>Subject: [PATCH 7/9] SDAP: new option - DN to ppolicy on
LDAP
>Do we need to make the DN configurable? When you install the ppolicy,
>can you actually set the DN?
I haven't tested setting different DN, but I believe it's possible.
During weekend I was putting my notes for setting ppolicy on OpenLDAP on
this wiki page
https://fedorahosted.org/sssd/wiki/openldap_ppolicy#Loadingppolicyoverlay
(this is work in progress and I'm not even sure we care to have such a
how-to on our wiki), but I believe you can see from there that DN is
configurable.
Any howto is good as long as it's up to date.
And from the howto it seems clear that olcPPolicyDefault is the DN
setting, so yes, this should be configurable.
Still we could use a default DN if user didn't set DN himself:
"cn=ppolicy,ou=policies,$search_base"
That sounds like a good idea.