[SSSD] [PATCH] Add support for ADS pwdLastSet

Pierre Carrier prc at redhat.com
Mon Apr 11 17:16:49 UTC 2011


Hello Stephen,


On 11 Apr 2011, at 17:26, Stephen Gallagher wrote:
> I have a question, first. Does Active Directory ALWAYS use this
> attribute, or can shadowLastChange also exist? If they can both exist,
> which one should be the primary for best compatibility (i.e. does AD
> define that one of them should overrule the other?)

You can definitely at least choose to create shadow* attributes yourself, obviously.

shadowLastChange _is_ defined on:
http://msdn.microsoft.com/en-us/library/ms679790(v=vs.85).aspx

[MS-ADTS] does not seem to enforce the existence of pwdLastSet, but it has FLAG_ATTR_IS_CRITICAL.

I'd go with:
- if shadowLastChange is here, use it
- if not, if pwdLastChanged is here, use it
- if not, fail miserably

> Please suppress whitespace on empty lines. It's very painful for those
> of us with editors that highlight this in red :)

Sorry, it even happens to be the case in my usual vim.

> I note also that your calculation was wrong, because it was dealing in

> nanoseconds, but pwdLastSet is a count of HUNDRED nanosecond blocks.

I have to admit I stole this in nss_ldap, where it is not documented either.

I'm surprised they made this mistake, I'll make sure to fix this.

> Finally, your assignment to the 'days' variable (which is a long) from
> an action involving two long long variables is risky. It would be wiser
> for 'days' to be a long long which you then test for whether it exceeds
> LONG_MAX.

I'll fix this too.


You can expect a new patch soon :)



Yours sincerely,

-- 
Pierre Carrier, Technical Support Engineer
Production Support, EMEA office
Global Support Services
Red Hat, Inc.


More information about the sssd-devel mailing list