URL:
https://github.com/SSSD/sssd/pull/269
Title: #269: Add support for ActiveDirectory's logonHours restrictions
jhrozek commented:
"""
On Fri, May 26, 2017 at 08:32:47AM -0700, lslebodn wrote:
>@NWilson would you like me to help move this PR forward by
writing a patch on top of yours that allows configure-time selection of the default?
I would rather prefer to set default value of option to NULL rather then creating
configure time option for any new "controversial" feature. + update man page for
`sssd-ad`
Why controversial? I think it's the same thing as GPOs -- it's something
that Windows would have enforced, so sssd-ad (which in this respects
pretents it's a Windows box) honors that.
Or in other words -- if we were writing sssd-ad from scratch and could
implement all features at once, this is something we would implement, I
think.
BTW man `sssd-ldap` says that default value of `ldap_user_ad_logon_hours` is `logonHours`
But such attribute is not part of rfc2307 or rfc2307 bis schema. So it should not be set (
== NULL) for standard ldap schemas anyway.
As pointed out in the review :)
"""
See the full comment at
https://github.com/SSSD/sssd/pull/269#issuecomment-304315615