[SSSD] [PATCHES] SDAP: Lock out ssh keys when account naturally expires

Lukas Slebodnik lslebodn at redhat.com
Thu Jan 22 09:22:22 UTC 2015


On (22/01/15 10:06), Pavel Reichl wrote:
>
>On 01/22/2015 09:51 AM, Lukas Slebodnik wrote:
>>On (22/01/15 09:45), Pavel Reichl wrote:
>>>On 01/22/2015 09:27 AM, Lukas Slebodnik wrote:
>>>>On (21/01/15 11:52), Pavel Reichl wrote:
>>>>>Hello,
>>>>>
>>>>>please see attached patches.
>>>>>
>>>>>Does it make sense to check on cases when pwdAccountLockedTime is some future
>>>>>time event?
>>>>>
>>>>>If agreed to I'll send patch adding test for new utility function
>>>>>convert_time().
>>>>>
>>>>>Thanks!
>>>>>From 4560b5d52e2c816df7b6479908a63cad6bbb8622 Mon Sep 17 00:00:00 2001
>>>>>From: Pavel Reichl <preichl at redhat.com>
>>>>>Date: Mon, 19 Jan 2015 03:24:09 -0500
>>>>>Subject: [PATCH 1/3] SDAP: new option - pwdlocking natural/only by admin
>>>>>
>>>>>This is a follow up to #2364.
>>>>>To distinguish user locked out from accessing machine via SSH if an
>>>>>account was administratively locked (pwdAccountLockedTime set to
>>>>>000001010000Z) in the OpenLDAP Password Policy overlay or if user
>>>>>password is locked out from natural reasons (too many attempts, expired
>>>>>password).
>>>>>
>>>>>Part of solution for:
>>>>>https://fedorahosted.org/sssd/ticket/2534
>>>>>---
>>>>@see https://lists.fedorahosted.org/pipermail/sssd-devel/2014-August/020467.html
>>>see commit in master: 022456e93c9b175ce3774afe524e3926f41ba80f
>>>>>From 84385a53068c4832d1c66eb3a767c8e553b24b4f Mon Sep 17 00:00:00 2001
>>>>>From: Pavel Reichl <preichl at redhat.com>
>>>>>Date: Tue, 20 Jan 2015 16:27:41 -0500
>>>>>Subject: [PATCH 2/3] UTIL: convert general time to unix time
>>>>>
>>>>>New utility function *convert_time* to convert 'general time' to
>>>>>'unix time'.
>>>>>---
>>>>>From c5fc4ea54bab0a9933148f4ef22a2d28cd5c71a7 Mon Sep 17 00:00:00 2001
>>>>>From: Pavel Reichl <preichl at redhat.com>
>>>>>Date: Tue, 20 Jan 2015 18:34:44 -0500
>>>>>Subject: [PATCH 3/3] SDAP: Lock out ssh keys when account naturally expires
>>>>>
>>>>>Resolves:
>>>>>https://fedorahosted.org/sssd/ticket/2534
>>>>>---
>>>>Have you considered to write unit test?
>>>For the second patch, yes.
>>So I'll wait for patchset with unit test(s).

>In my first post I wrote
>> If agreed to I'll send patch adding test for new utility function
>> convert_time().
>So you could just write that you think this utility function is a good idea
>and I would prepare the test then. Never mind, I'll do it asap, as it seems
>really vital for you.
The new utility function is not documented and does not have a unit test.
It isn't about my preferences. It's about best practices and improving our code
coverage.

>BTW do you prefer the unit test to be in the same patch as the tested utility
>function or in a separate patch? Thanks.
New function has just 37 lines. The unit test in separate patch make sense
if functionality is very complicated itself.

You should remember the fact that small utility function can be back ported
to older branches after few months and you can forget to back port test.

LS



More information about the sssd-devel mailing list