On 05/11/2015 12:24 PM, Jakub Hrozek wrote:
On Wed, Mar 25, 2015 at 10:19:39AM +0100, Pavel Reichl wrote:
> Hello,
>
> attached patch deprecates lockout option in 1-12 branch.
>
> This was discussed in thread: SDAP: Lock out ssh keys when account naturally expires
> This patch implements point number 2.
>
>>> I would prefer if we didn't add a new option as well, but since we
released
>>> a version that only supported the lockout and not any other semantics,
>>> I don't think we can get away with just changing the functionality. A
>>> minor version can break functionality. But a major version can
>>>
>>> So I propose the following:
>>> 1) Add a new value for ldap_access_order called "ppolicy" that
would
>>> evaluate the pwdAccountLockedTime fully, including the new
>>> functionality in this patchset
>>> 2) In 1.12, deprecate the "lockout" option and log a warning that
it
>>> will be removed in future relase and users should migrate to
"ppolicy"
>>> option
>>> 3) In master (1.13), remove the "lockout" ldap_access_order value
> I'll send patch for point number 3 in separate thread.
>
> Thanks!
I'm sorry it took so long to get back to this patch.
> From 3adee0c2ff207eef7c2edcfed80eb47754570210 Mon Sep 17 00:00:00 2001
> From: Pavel Reichl <preichl(a)redhat.com>
> Date: Wed, 25 Mar 2015 05:03:12 -0400
> Subject: [PATCH] LDAP: warn about lockout option being deprecated
>
> ---
> src/man/sssd-ldap.5.xml | 7 +++++++
> src/providers/ldap/sdap_access.c | 9 ++++++++-
> 2 files changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
> index
00da3964af7619f19525e76c4f1292586dd60f54..b46e07fec96ffa7305ab41ce42c16b2e94e53292 100644
> --- a/src/man/sssd-ldap.5.xml
> +++ b/src/man/sssd-ldap.5.xml
> @@ -1955,6 +1955,13 @@ ldap_access_filter = (employeeType=admin)
> be set for this feature to work.
> </para>
> <para>
> + <emphasis>
> + Please note that this option is superseded by
> + ppolicy option and will be dropped in next major
> + release.
Since we can't remove the option soon, I'd say "might be removed in a
future release". It would also be nice to point the admin to the option
he should be using now instead.
OK, I mentioned ppolicy option for the second time,
or did you just want
me to rephrase the sentence?
> + </emphasis>
> + </para>
> + <para>
> <emphasis>ppolicy</emphasis>: use account
locking.
> If set, this option denies access in case that ldap
> attribute 'pwdAccountLockedTime' is present and
has
> diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
> index
0b251121335841b357e55deac608f50e24311285..cefd2a23887bef0250697c55235fa96fdb769ce2 100644
> --- a/src/providers/ldap/sdap_access.c
> +++ b/src/providers/ldap/sdap_access.c
> @@ -212,7 +212,13 @@ static errno_t sdap_access_check_next_rule(struct
sdap_access_req_ctx *state,
> /* we are done with no errors */
> return EOK;
>
> + /* This option is deprecated by LDAP_ACCESS_PPOLICY */
> case LDAP_ACCESS_LOCKOUT:
> + DEBUG(SSSDBG_MINOR_FAILURE,
> + "WARNING %s option is deprecated and will be removed in
"
> + "future release. Please migrate to %s option
instead.\n",
> + LDAP_ACCESS_LOCK_NAME, LDAP_ACCESS_PPOLICY_NAME);
Same comment here.
> +
> subreq = sdap_access_ppolicy_send(state, state->ev,
state->be_ctx,
> state->domain,
> state->access_ctx,
> @@ -221,7 +227,8 @@ static errno_t sdap_access_check_next_rule(struct
sdap_access_req_ctx *state,
> state->user_entry,
> PWP_LOCKOUT_ONLY);
> if (subreq == NULL) {
> - DEBUG(SSSDBG_CRIT_FAILURE, "sdap_access_ppolicy_send
failed.\n");
> + DEBUG(SSSDBG_CRIT_FAILURE,
> + "sdap_access_ppolicy_send failed.\n");
> return ENOMEM;
> }
>
> --
> 2.1.0
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel