[SSSD] [PATCHES] SDAP: Be able to configure sssd to honor openldap account lock to restrict access via ssh key

Jakub Hrozek jhrozek at redhat.com
Mon Aug 11 14:51:05 UTC 2014


On Mon, Aug 11, 2014 at 04:19:22PM +0200, Pavel Reichl wrote:
> >>Subject: [PATCH 7/9] SDAP: new option - DN to ppolicy on LDAP
> >Do we need to make the DN configurable? When you install the ppolicy,
> >can you actually set the DN?
> I haven't tested setting different DN, but I believe it's possible.
> During weekend I was putting my notes for setting ppolicy on OpenLDAP on
> this wiki page
> https://fedorahosted.org/sssd/wiki/openldap_ppolicy#Loadingppolicyoverlay
> (this is work in progress and I'm not even sure we care to have such a
> how-to on our wiki), but I believe you can see from there that DN is
> configurable.

Any howto is good as long as it's up to date.

And from the howto it seems clear that olcPPolicyDefault is the DN
setting, so yes, this should be configurable.

> 
> Still we could use a default DN if user didn't set DN himself:
> 
> "cn=ppolicy,ou=policies,$search_base"

That sounds like a good idea.



More information about the sssd-devel mailing list