[SSSD] Here is a patch for sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout'
Jakub Hrozek
jhrozek at redhat.com
Wed Oct 22 14:26:47 UTC 2014
On Wed, Oct 15, 2014 at 09:30:50AM -0400, Dan Lavu wrote:
> Here you go, sorry for all the little errors, I'm still new to this.
Sorry for the delay in the review..
ACK!
>
> On Tue, Oct 14, 2014 at 8:38 AM, Jakub Hrozek <jhrozek at redhat.com> wrote:
>
> > On Mon, Oct 13, 2014 at 03:36:54PM -0400, Dan Lavu wrote:
> > > I had a merge issue, so I just redid the patch (with some minor changes)
> > after a rebase, so it should be good now?
> >
> > There are two typos, see inline. After fixing these, I'll ACK :-)
> >
> > > From 61b96bb58b0a6e078708c45794c1067d1be2d133 Mon Sep 17 00:00:00 2001
> > > From: Dan Lavu <dlavu at redhat.com>
> > > Date: Mon, 13 Oct 2014 15:06:53 -0400
> > > Subject: [PATCH] MAN PAGE: modified sssd-ldap.5.xml for sssd ticket #2451
> > >
> > > Added a configuration example at the bottom for
> > > 'ldap_access_order = lockout'. Also added a line
> > > to note that 'ldap_access_provider = ldap' must
> > > be specified for this feature to work.
> > > ---
> > > src/man/sssd-ldap.5.xml | 26 +++++++++++++++++++++++++-
> > > 1 file changed, 25 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
> > > index
> > 03ea7948b69ed28945fc614eee5c47195cd85937..b5e971fd036cbb0e89b821b267551196edfcd4e7
> > 100644
> > > --- a/src/man/sssd-ldap.5.xml
> > > +++ b/src/man/sssd-ldap.5.xml
> > > @@ -1921,7 +1921,10 @@ ldap_access_filter = (employeeType=admin)
> > > If set, this option denies access in case
> > that ldap
> > > attribute 'pwdAccountLockedTime' is present
> > and has
> > > value of '000001010000Z'. Please see the
> > option
> > > - ldap_pwdlockout_dn.
> > > + ldap_pwdlockout_dn.
> > > +
> > > + Please note that 'ldap_access_provider =
> > ldap' must
> >
> > The option is called just 'access_provider', not 'ldap_access_provider'.
> >
> > > + be set for this feature to work.
> > > </para>
> > > <para>
> > > <emphasis>expire</emphasis>: use
> > > @@ -2491,6 +2494,27 @@ ldap_access_filter = (employeeType=admin)
> > > </programlisting>
> > > </para>
> > > </refsect1>
> > > + <refsect1 id='ldap_access_filter_example'>
> > > + <title>LDAP ACCESS FILTER EXAMPLE</title>
> > > + <para>
> > > + The following example assumes that SSSD is correctly
> > > + configured and to use the ldap_access_order=lockout.
> > > + </para>
> > > + <para>
> > > +<programlisting>
> > > + [domain/LDAP]
> > > + id_provider = ldap
> > > + auth_provider = ldap
> > > + access_provider = ldap
> > > + ldap_Access_order = lockout
> >
> > The options in SSSD are all lowercased, so this one should read:
> > ldap_access_order
> >
> > > + ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=mydomain,dc=org
> > > + ldap_uri = ldap://ldap.mydomain.org
> > > + ldap_search_base = dc=mydomain,dc=org
> > > + ldap_tls_reqcert = demand
> > > + cache_credentials = true
> > > +</programlisting>
> > > + </para>
> > > + </refsect1>
> > >
> > > <refsect1 id='notes'>
> > > <title>NOTES</title>
> > > --
> > > 1.9.3
> > > _______________________________________________
> > > sssd-devel mailing list
> > > sssd-devel at lists.fedorahosted.org
> > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >
> From 1c629f2da937be8bba111e76bfd10626fe0c86c0 Mon Sep 17 00:00:00 2001
> From: Dan Lavu <dlavu at redhat.com>
> Date: Mon, 13 Oct 2014 15:06:53 -0400
> Subject: [PATCH] MAN PAGE: modified sssd-ldap.5.xml for sssd ticket #2451
>
> Added a configuration example at the bottom for
> 'ldap_access_order = lockout'. Also added a line
> to note that 'ldap_access_provider = ldap' must
> be specified for this feature to work.
> ---
> src/man/sssd-ldap.5.xml | 26 +++++++++++++++++++++++++-
> 1 file changed, 25 insertions(+), 1 deletion(-)
>
> diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
> index 03ea7948b69ed28945fc614eee5c47195cd85937..3f7d07a8cf668eb54bfc10139813d09f1cc61e11 100644
> --- a/src/man/sssd-ldap.5.xml
> +++ b/src/man/sssd-ldap.5.xml
> @@ -1449,7 +1449,7 @@
> <listitem>
> <para>
> Specifies acceptable cipher suites. Typically this
> - is a colon sperated list. See
> + is a colon sperated list. See
> <citerefentry><refentrytitle>ldap.conf</refentrytitle>
> <manvolnum>5</manvolnum></citerefentry> for format.
> </para>
> @@ -1922,6 +1922,9 @@ ldap_access_filter = (employeeType=admin)
> attribute 'pwdAccountLockedTime' is present and has
> value of '000001010000Z'. Please see the option
> ldap_pwdlockout_dn.
> +
> + Please note that 'access_provider = ldap' must
> + be set for this feature to work.
> </para>
> <para>
> <emphasis>expire</emphasis>: use
> @@ -2491,6 +2494,27 @@ ldap_access_filter = (employeeType=admin)
> </programlisting>
> </para>
> </refsect1>
> + <refsect1 id='ldap_access_filter_example'>
> + <title>LDAP ACCESS FILTER EXAMPLE</title>
> + <para>
> + The following example assumes that SSSD is correctly
> + configured and to use the ldap_access_order=lockout.
> + </para>
> + <para>
> +<programlisting>
> + [domain/LDAP]
> + id_provider = ldap
> + auth_provider = ldap
> + access_provider = ldap
> + ldap_access_order = lockout
> + ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=mydomain,dc=org
> + ldap_uri = ldap://ldap.mydomain.org
> + ldap_search_base = dc=mydomain,dc=org
> + ldap_tls_reqcert = demand
> + cache_credentials = true
> +</programlisting>
> + </para>
> + </refsect1>
>
> <refsect1 id='notes'>
> <title>NOTES</title>
> --
> 1.9.3
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
More information about the sssd-devel
mailing list