[SSSD] Here is a patch for sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout'

Jakub Hrozek jhrozek at redhat.com
Tue Oct 14 12:38:16 UTC 2014


On Mon, Oct 13, 2014 at 03:36:54PM -0400, Dan Lavu wrote:
> I had a merge issue, so I just redid the patch (with some minor changes) after a rebase, so it should be good now? 

There are two typos, see inline. After fixing these, I'll ACK :-)

> From 61b96bb58b0a6e078708c45794c1067d1be2d133 Mon Sep 17 00:00:00 2001
> From: Dan Lavu <dlavu at redhat.com>
> Date: Mon, 13 Oct 2014 15:06:53 -0400
> Subject: [PATCH] MAN PAGE: modified sssd-ldap.5.xml for sssd ticket #2451
> 
> Added a configuration example at the bottom for
> 'ldap_access_order = lockout'. Also added a line
> to note that 'ldap_access_provider = ldap' must
> be specified for this feature to work.
> ---
>  src/man/sssd-ldap.5.xml | 26 +++++++++++++++++++++++++-
>  1 file changed, 25 insertions(+), 1 deletion(-)
> 
> diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
> index 03ea7948b69ed28945fc614eee5c47195cd85937..b5e971fd036cbb0e89b821b267551196edfcd4e7 100644
> --- a/src/man/sssd-ldap.5.xml
> +++ b/src/man/sssd-ldap.5.xml
> @@ -1921,7 +1921,10 @@ ldap_access_filter = (employeeType=admin)
>                              If set, this option denies access in case that ldap
>                              attribute 'pwdAccountLockedTime' is present and has
>                              value of '000001010000Z'. Please see the option
> -                            ldap_pwdlockout_dn.
> +                            ldap_pwdlockout_dn. 
> +
> +                            Please note that 'ldap_access_provider = ldap' must

The option is called just 'access_provider', not 'ldap_access_provider'.

> +                            be set for this feature to work.
>                          </para>
>                          <para>
>                              <emphasis>expire</emphasis>: use
> @@ -2491,6 +2494,27 @@ ldap_access_filter = (employeeType=admin)
>  </programlisting>
>          </para>
>      </refsect1>
> +    <refsect1 id='ldap_access_filter_example'>
> +        <title>LDAP ACCESS FILTER EXAMPLE</title>
> +        <para>
> +            The following example assumes that SSSD is correctly
> +            configured and to use the ldap_access_order=lockout. 
> +        </para>
> +        <para>
> +<programlisting>
> +    [domain/LDAP]
> +    id_provider = ldap
> +    auth_provider = ldap
> +    access_provider = ldap
> +    ldap_Access_order = lockout

The options in SSSD are all lowercased, so this one should read:
ldap_access_order

> +    ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=mydomain,dc=org 
> +    ldap_uri = ldap://ldap.mydomain.org
> +    ldap_search_base = dc=mydomain,dc=org
> +    ldap_tls_reqcert = demand
> +    cache_credentials = true
> +</programlisting>
> +        </para>
> +    </refsect1>
> 
>      <refsect1 id='notes'>
>          <title>NOTES</title>
> -- 
> 1.9.3
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list