[SSSD] [PATCH] LDAP: drop lockout option from ldap_access_order

Lukas Slebodnik lslebodn at redhat.com
Wed Mar 25 20:53:14 UTC 2015


On (25/03/15 14:35), Pavel Reichl wrote:
>
>
>On 03/25/2015 02:21 PM, Lukas Slebodnik wrote:
>>On (25/03/15 14:05), Pavel Reichl wrote:
>>>
>>>On 03/25/2015 01:51 PM, Lukas Slebodnik wrote:
>>>>On (25/03/15 12:01), Pavel Reichl wrote:
>>>>>Hello please see attached patch.
>>>>>
>>>>>The need for this patch was discussed in thread: SDAP: Lock out ssh keys when
>>>>>account naturally expires
>>>>>This patch implements point number 3.
>>>>>
>>>>>>>I would prefer if we didn't add a new option as well, but since we
>>>>>>>released
>>>>>>>a version that only supported the lockout and not any other semantics,
>>>>>>>I don't think we can get away with just changing the functionality. A
>>>>>>>minor version can break functionality. But a major version can
>>>>>>>
>>>>>>>So I propose the following:
>>>>>>>1) Add a new value for ldap_access_order called "ppolicy" that would
>>>>>>>evaluate the pwdAccountLockedTime fully, including the new
>>>>>>>functionality in this patchset
>>>>>>>2) In 1.12, deprecate the "lockout" option and log a warning that it
>>>>>>>will be removed in future relase and users should migrate to "ppolicy"
>>>>>>>option
>>>>The feature was introduced in sssd-1.12.1 and deprecated in sssd-1.12.5
>>>>That's really fast progres. The deprecating the features
>>>>after half a year.
>>>>
>>>>Could someone exaplain me why do we need to do such ritual dances?
>>>>
>>>>LS
>>>First there was user ho wanted lockout functionality that is being dropped
>>>now. https://fedorahosted.org/sssd/ticket/2364
>>>
>>>Then a few months later there came another user with
>>>https://fedorahosted.org/sssd/ticket/2534 who wished to do something similar
>>>but different.
>>>
I checked bugzilla tickets and the same user requested both features.

>>>We think that user case addressed in 1st ticket can be handled by
>>>functionality introduced for 2nd ticket.
>>>
>>I mentioned it as a part of review a month ago.
>>So you needn't explain it to me.
>I'm sorry then.
>>
>>>So we decided to drop functionality for the first patch.  Is it clear now?
>>>
>>The only think which I do not understand is why do we need to drop it know
>>and it could not be part of ticket #2534
>It is my understanding we could not drop the functionality in 1.12 - as there
>are users who use it - so we needed to keep both.
>
>But I think you are right that we could drop it in master as part of #2534.
>Might be you remember that we were on tight schedule then and we simply
>forget to this extra work for master.
>Now QE reminded us a created a BZ.
BZ1205604 says:
  Expected results:
  Only ppolicy works since it is stricter than lockout

So your patch is wrong and we need to drop functionality even in 1.12

NACK

LS



More information about the sssd-devel mailing list