[SSSD] [PATCH] LDAP: warn about lockout option being deprecated

Pavel Reichl preichl at redhat.com
Thu Apr 2 14:54:34 UTC 2015



On 03/25/2015 10:19 AM, Pavel Reichl wrote:
> Hello,
>
> attached patch deprecates lockout option in 1-12 branch.
>
> This was discussed in thread: SDAP: Lock out ssh keys when account 
> naturally expires
> This patch implements point number 2.
>
>>> I would prefer if we didn't add a new option as well, but since we 
>>> released
>>> a version that only supported the lockout and not any other semantics,
>>> I don't think we can get away with just changing the functionality. A
>>> minor version can break functionality. But a major version can
>>>
>>> So I propose the following:
>>> 1) Add a new value for ldap_access_order called "ppolicy" that would
>>> evaluate the pwdAccountLockedTime fully, including the new
>>> functionality in this patchset
>>> 2) In 1.12, deprecate the "lockout" option and log a warning that it
>>> will be removed in future relase and users should migrate to "ppolicy"
>>> option
>>> 3) In master (1.13), remove the "lockout" ldap_access_order value
> I'll send patch for point number 3 in separate thread.
>
> Thanks!
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello,

can we discuss this patch? I think it's still relevant.

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150402/296c6287/attachment.html>


More information about the sssd-devel mailing list