On Wed, Mar 25, 2015 at 10:19:39AM +0100, Pavel Reichl wrote:
Hello,
attached patch deprecates lockout option in 1-12 branch.
This was discussed in thread: SDAP: Lock out ssh keys when account naturally expires
This patch implements point number 2.
>>I would prefer if we didn't add a new option as well, but since we released
>>a version that only supported the lockout and not any other semantics,
>>I don't think we can get away with just changing the functionality. A
>>minor version can break functionality. But a major version can
>>
>>So I propose the following:
>>1) Add a new value for ldap_access_order called "ppolicy" that would
>>evaluate the pwdAccountLockedTime fully, including the new
>>functionality in this patchset
>>2) In 1.12, deprecate the "lockout" option and log a warning that it
>>will be removed in future relase and users should migrate to "ppolicy"
>>option
>>3) In master (1.13), remove the "lockout" ldap_access_order value
I'll send patch for point number 3 in separate thread.
Thanks!
I'm sorry it took so long to get back to this patch.
From 3adee0c2ff207eef7c2edcfed80eb47754570210 Mon Sep 17 00:00:00
2001
From: Pavel Reichl <preichl(a)redhat.com>
Date: Wed, 25 Mar 2015 05:03:12 -0400
Subject: [PATCH] LDAP: warn about lockout option being deprecated
---
src/man/sssd-ldap.5.xml | 7 +++++++
src/providers/ldap/sdap_access.c | 9 ++++++++-
2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 00da3964af7619f19525e76c4f1292586dd60f54..b46e07fec96ffa7305ab41ce42c16b2e94e53292
100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1955,6 +1955,13 @@ ldap_access_filter = (employeeType=admin)
be set for this feature to work.
</para>
<para>
+ <emphasis>
+ Please note that this option is superseded by
+ ppolicy option and will be dropped in next major
+ release.
Since we can't remove the option soon, I'd say "might be removed in a
future release". It would also be nice to point the admin to the option
he should be using now instead.
+ </emphasis>
+ </para>
+ <para>
<emphasis>ppolicy</emphasis>: use account
locking.
If set, this option denies access in case that ldap
attribute 'pwdAccountLockedTime' is present and has
diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
index 0b251121335841b357e55deac608f50e24311285..cefd2a23887bef0250697c55235fa96fdb769ce2
100644
--- a/src/providers/ldap/sdap_access.c
+++ b/src/providers/ldap/sdap_access.c
@@ -212,7 +212,13 @@ static errno_t sdap_access_check_next_rule(struct
sdap_access_req_ctx *state,
/* we are done with no errors */
return EOK;
+ /* This option is deprecated by LDAP_ACCESS_PPOLICY */
case LDAP_ACCESS_LOCKOUT:
+ DEBUG(SSSDBG_MINOR_FAILURE,
+ "WARNING %s option is deprecated and will be removed in "
+ "future release. Please migrate to %s option instead.\n",
+ LDAP_ACCESS_LOCK_NAME, LDAP_ACCESS_PPOLICY_NAME);
Same comment here.
+
subreq = sdap_access_ppolicy_send(state, state->ev, state->be_ctx,
state->domain,
state->access_ctx,
@@ -221,7 +227,8 @@ static errno_t sdap_access_check_next_rule(struct sdap_access_req_ctx
*state,
state->user_entry,
PWP_LOCKOUT_ONLY);
if (subreq == NULL) {
- DEBUG(SSSDBG_CRIT_FAILURE, "sdap_access_ppolicy_send
failed.\n");
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "sdap_access_ppolicy_send failed.\n");
return ENOMEM;
}
--
2.1.0
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel