URL:
https://github.com/SSSD/sssd/pull/269
Title: #269: Add support for ActiveDirectory's logonHours restrictions
jhrozek commented:
"""
So I finally had some time to test this PR (sorry again for the long delays..).
There is a trivial fix that needs to be squashed to prevent segfaults for users with no
logonHours:
```
- } else if (ad_account_outside_logonhours(logon_hours->data)) {
+ } else if (logon_hours != NULL
+ && ad_account_outside_logonhours(logon_hours->data)) {
```
Also, MIN() and MAX() were not defined on my system, but that's a one-liner for each
macro.
But, more importantly, the logonHours attribute is not replicated to the Global Catalog,
so with our current model of preferring the GC, we don't fetch the attribute. It would
be trivial to make the PAM account requests hit the LDAP port, but then with our current
LDAP attribute handling, any subsequent GC request would treat the attribute as removed.
I currently don't know how to solve that except disabling the GC support in case
someone enabled the logonHours support (which implies adding a runtime option for the
logonHours support, defaulting to false).
The comments I had previously about the IPA environments were not valid at least on IPA
clients, because those do not receive the attribute through the extdom operation. I
haven't tested an IPA server yet.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/269#issuecomment-332320647