[SSSD] [PATCHES] SDAP: Be able to configure sssd to honor openldap account lock to restrict access via ssh key

Pavel Reichl preichl at redhat.com
Fri Aug 15 13:13:42 UTC 2014


On 08/11/2014 04:51 PM, Jakub Hrozek wrote:
> On Mon, Aug 11, 2014 at 04:19:22PM +0200, Pavel Reichl wrote:
>>>> Subject: [PATCH 7/9] SDAP: new option - DN to ppolicy on LDAP
>>> Do we need to make the DN configurable? When you install the ppolicy,
>>> can you actually set the DN?
>> I haven't tested setting different DN, but I believe it's possible.
>> During weekend I was putting my notes for setting ppolicy on OpenLDAP on
>> this wiki page
>> https://fedorahosted.org/sssd/wiki/openldap_ppolicy#Loadingppolicyoverlay
>> (this is work in progress and I'm not even sure we care to have such a
>> how-to on our wiki), but I believe you can see from there that DN is
>> configurable.
> Any howto is good as long as it's up to date.
>
> And from the howto it seems clear that olcPPolicyDefault is the DN
> setting, so yes, this should be configurable.
>
>> Still we could use a default DN if user didn't set DN himself:
>>
>> "cn=ppolicy,ou=policies,$search_base"
> That sounds like a good idea.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello,

please note that attached patches requires to be patches from "SDAP: 
refactor sdap_access" thread to pushed first.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-SDAP-split-sdap_access_filter_get_access_done.patch
Type: text/x-patch
Size: 3813 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-SDAP-refactor-sdap_access_filter_send.patch
Type: text/x-patch
Size: 3563 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-SDAP-nitpicks-in-sdap_access_filter_get_access_done.patch
Type: text/x-patch
Size: 2137 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-SDAP-refactor-sdap_access_filter_done.patch
Type: text/x-patch
Size: 6370 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-SDAP-don-t-log-error-on-access-denied.patch
Type: text/x-patch
Size: 1149 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-SDAP-refactor-AC-offline-checks.patch
Type: text/x-patch
Size: 2414 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-SDAP-new-option-DN-to-ppolicy-on-LDAP.patch
Type: text/x-patch
Size: 5510 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0008-SDAP-account-lockout-to-restrict-access-via-ssh-key.patch
Type: text/x-patch
Size: 23174 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment-0007.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0009-MAN-options-lockout-and-ldap_pwdlockout_dn.patch
Type: text/x-patch
Size: 2611 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140815/3bc5389d/attachment-0008.bin>


More information about the sssd-devel mailing list