-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/25/2010 08:25 AM, Sumit Bose wrote:
Hi,
these two patches aim to fix trac ticket #672. While the first patch
only makes a utility function public the second adds some new layers to
the LDAP access provider. I've tried to make the changes in a way to
make it easy to add new rules (#670) and new expire policies (#673,
#674, #690).
I would like to ask the reviewers to check if the new code is really as
flexible as I think and if it enough to evaluate the shadow expire
attribute here. TIA
bye,
Sumit
Patch 0001: Ack.
Patch 0002: Nack.
The manpage entry for ldap_account_expire_policy should list the valid
values for this option. The patch comment notes that this is only
"shadow" at present.
sssm_ldap_access_init() should throw an error (or at least warn and
ignore it) if we get a duplicate access rule. e.g.:
ldap_access_order = filter, filter
Please rename sdap_access_decide_offline(), sdap_access_retry(),
sdap_access_connect_done() and sdap_access_get_access_done() to be clear
that they apply to the access_filter.
I'm not sure we want to deny on a missing password expiration attribute.
Some users might be lacking this attribute with the intent that it means
"no expiration". Maybe we should add a strictness option here.
next_access_rule() should probably return on PAM_ACCT_EXPIRED, not just
PAM_PERM_DENIED.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkz3poUACgkQeiVVYja6o6OzvQCfesHt9x72o974xPOquRY0NtKt
1VAAn2/yojzemyFBhnv9Zbm3HLQk6rr1
=SinO
-----END PGP SIGNATURE-----