[SSSD] [PATCHES] Check nsAccountLock during IPA pam_acct_mgmt

Stephen Gallagher sgallagh at redhat.com
Thu Mar 8 20:42:21 UTC 2012


Patch 0001: Make sdap_access_send() public so the IPA provider can
consume it.

Patch 0002: Check that the user is not disabled before performing the
HBAC check. I chose to do the nsAccountLock check first because it's a
very fast operation against the cache, so if it returns PAM_PERM_DENIED
we will skip the slower HBAC checks and jump straight to denial.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-LDAP-Make-sdap_access_send-recv-public.patch
Type: text/x-patch
Size: 3243 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120308/66490fe9/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-IPA-Check-nsAccountLock-during-PAM_ACCT_MGMT.patch
Type: text/x-patch
Size: 6795 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120308/66490fe9/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120308/66490fe9/attachment.sig>


More information about the sssd-devel mailing list