[SSSD] [PATCH] LDAP: drop lockout option from ldap_access_order

Pavel Reichl preichl at redhat.com
Wed Mar 25 11:01:06 UTC 2015


Hello please see attached patch.

The need for this patch was discussed in thread: SDAP: Lock out ssh keys 
when account naturally expires
This patch implements point number 3.

>> I would prefer if we didn't add a new option as well, but since we 
>> released
>> a version that only supported the lockout and not any other semantics,
>> I don't think we can get away with just changing the functionality. A
>> minor version can break functionality. But a major version can
>>
>> So I propose the following:
>> 1) Add a new value for ldap_access_order called "ppolicy" that would
>> evaluate the pwdAccountLockedTime fully, including the new
>> functionality in this patchset
>> 2) In 1.12, deprecate the "lockout" option and log a warning that it
>> will be removed in future relase and users should migrate to "ppolicy"
>> option
>> 3) In master (1.13), remove the "lockout" ldap_access_order value

Thanks!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-LDAP-drop-lockout-option-from-ldap_access_order.patch
Type: text/x-patch
Size: 11786 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150325/d915e905/attachment.bin>


More information about the sssd-devel mailing list