[SSSD] [PATCHES] SDAP: Be able to configure sssd to honor openldap account lock to restrict access via ssh key

Pavel Reichl preichl at redhat.com
Fri Aug 1 17:48:01 UTC 2014


Hello,

please see attached patches. Every patch is documented in its commit 
message.

Generally speaking the first 6 patches are preparation for patch #8.

Thanks,

Pavel Reichl

PS: I also attached output of my testing to make it more obvious how the 
patches are supposed to work.

------------------------------------------------------------------------
# john, people, example.com
dn: uid=john,ou=people,dc=example,dc=com
pwdAccountLockedTime: 000001010000Z

# max, people, example.com
dn: uid=max,ou=people,dc=example,dc=com

# dick, people, example.com
dn: uid=dick,ou=people,dc=example,dc=com
pwdAccountLockedTime: 20140801115742Z
--------------------------------------------------------------------------
$ ssh -l john at openldap `hostname`
Connection closed by UNKNOWN

$ ssh -l max at openldap `hostname`
Last login: Fri Aug  1 15:16:21 2014 from sssd.dev.work

$ ssh -l dick at openldap `hostname`
Last login: Fri Aug  1 12:57:33 2014

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-SDAP-split-sdap_access_filter_get_access_done.patch
Type: text/x-patch
Size: 3959 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140801/322c1622/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-SDAP-refactor-sdap_access_filter_send.patch
Type: text/x-patch
Size: 3454 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140801/322c1622/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-SDAP-nitpicks-in-sdap_access_filter_get_access_done.patch
Type: text/x-patch
Size: 2137 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140801/322c1622/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-SDAP-refactor-sdap_access_filter_done.patch
Type: text/x-patch
Size: 2653 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140801/322c1622/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-SDAP-don-t-log-error-on-access-denied.patch
Type: text/x-patch
Size: 1184 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140801/322c1622/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-SDAP-use-versatile-name-for-caching-AC-results.patch
Type: text/x-patch
Size: 4252 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140801/322c1622/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-MAN-document-new-option-lock-of-ldap_access_order.patch
Type: text/x-patch
Size: 1304 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140801/322c1622/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0008-SDAP-account-lock-to-restrict-access-via-ssh-key.patch
Type: text/x-patch
Size: 14789 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140801/322c1622/attachment-0007.bin>


More information about the sssd-devel mailing list