[SSSD] supportedControl and OpenLDAP
Sumit Bose
sbose at redhat.com
Thu Jun 16 09:32:19 UTC 2011
Hi,
by chance I realized that an OpenLDAP server does not list all controls
it can handle in the rootDSE attribute supportedControl.
Especially LDAP_CONTROL_PASSWORDPOLICY is not listed. According to the
OpenLDAP developers this is because the related spec
(http://tools.ietf.org/html/draft-behera-ldap-password-policy-10) is
still a draft and not finalized
(http://www.openldap.org/lists/openldap-software/200606/msg00220.html).
Since sssd only uses controls which are in the supportedControl list we
will not be able to give the user expiration warnings or information
about grace logins for OpenLDAP servers with the password policy overlay
enabled.
I'm not sure if we need to do anything about it but at least I think it
is good to be aware of.
bye,
Sumit
More information about the sssd-devel
mailing list