-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
These patches must be applied on top of the "Do not check entries..." one.
[PATCH 1/2] Store lastLogin attribute when authenticating online This is needed for the second patch as we rely on lastLogin to decide whether to delete an entry or not.
[PATCH 2/2] Better cleanup task handling Implements a different mechanism for cleanup task. Instead of just deleting expired entries, this patch adds a new option login_cache_timeout for domains. If an entry is expired and the last login was more days in the past that login_cache_timeout, the entry is deleted.
Groups are deleted if they are expired and and no user references them (no user has memberof: attribute pointing at that group).
The parameter login_cache_timeout is not LDAP-specific, so that other future backends might use the same timeout setting.