[SSSD] [PATCH] Improvements for LDAP Password Policy support

Ralf Haferkamp rhafer at suse.de
Wed Mar 17 14:33:38 UTC 2010


Hi,

here's another set of enhancements to the LDAP Password Policy support in 
the PAM module and the LDAP backend. The PAM module now issues warning 
when either the grace counter or the expire counter of the LDAP Ppolicy 
Control in > 0. 

Addtionally I changed the detection for Ppolicy support of the LDAP 
Server a bit. If the Server returned the Ppolicy Control in the Bind 
Response  ppolicy support is assumed.

I left the original check for "pwdAttribute" intact, though I think it 
doesn't make a lot of sense. The "pwdAttribute" LDAP Attribute is usually 
not part of the user's entry, it's part of the Entry that contains the 
Policy. Addtionally it might be protected by ACLs and not be returned for 
anonymous (without losing any functionality).

-- 
Ralf
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Improvements-for-LDAP-Password-Policy-support.patch
Type: text/x-patch
Size: 15613 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100317/19d9f88b/attachment.bin>


More information about the sssd-devel mailing list