[SSSD] [PATCH] Add new account expired rule to LDAP access provider

Stephen Gallagher sgallagh at redhat.com
Thu Dec 2 14:00:37 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/25/2010 08:25 AM, Sumit Bose wrote:
> Hi,
> 
> these two patches aim to fix trac ticket #672. While the first patch
> only makes a utility function public the second adds some new layers to
> the LDAP access provider. I've tried to make the changes in a way to
> make it easy to add new rules (#670) and new expire policies (#673,
> #674, #690).
> 
> I would like to ask the reviewers to check if the new code is really as
> flexible as I think and if it enough to evaluate the shadow expire
> attribute here. TIA
> 
> bye,
> Sumit
> 


Patch 0001: Ack.

Patch 0002: Nack.
The manpage entry for ldap_account_expire_policy should list the valid
values for this option. The patch comment notes that this is only
"shadow" at present.

sssm_ldap_access_init() should throw an error (or at least warn and
ignore it) if we get a duplicate access rule. e.g.:
ldap_access_order = filter, filter

Please rename sdap_access_decide_offline(), sdap_access_retry(),
sdap_access_connect_done() and sdap_access_get_access_done() to be clear
that they apply to the access_filter.

I'm not sure we want to deny on a missing password expiration attribute.
Some users might be lacking this attribute with the intent that it means
"no expiration". Maybe we should add a strictness option here.

next_access_rule() should probably return on PAM_ACCT_EXPIRED, not just
PAM_PERM_DENIED.


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkz3poUACgkQeiVVYja6o6OzvQCfesHt9x72o974xPOquRY0NtKt
1VAAn2/yojzemyFBhnv9Zbm3HLQk6rr1
=SinO
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list