[SSSD] [Freeipa-devel] Proposed changes to the HBAC grammar

Dmitri Pal dpal at redhat.com
Thu Nov 18 13:37:32 UTC 2010


Simo Sorce wrote:
> On Thu, 18 Nov 2010 07:21:04 -0500
> Stephen Gallagher <sgallagh at redhat.com> wrote:
>
>   
>> Doing the forward septets is easy (1*x..7*x), but the reverse septets
>> are more complicated (since they would be (y-1*x..y-7*x), where y is
>> the total number of days in the month (which also has to account for
>> leap years).
>>
>> I think it might be a nice enhancement, but I recommend that we not
>> include it right now, given the tight release schedule for FreeIPA v2.
>>     
>
> As I said before it is a now or never condition.
> If you do not put it in now, then when you put it in, old clients will
> not understand the rule. And they will have only one option, always
> deny access, because they have no way to understand when it is ok to
> allow/deny it.
>
> Simo.
>
>   
What about just using the cron spec then with the addition of the duration?
And completely abandon our grammar for the periodic part (I know it is a
lot of work and start over again but if we have one shot wouldn't it be
best to use something existing?)
Will that work?

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/




More information about the sssd-devel mailing list