[SSSD] [PATCH] LDAP: drop lockout option from ldap_access_order

Lukas Slebodnik lslebodn at redhat.com
Wed Mar 25 20:57:33 UTC 2015


On (25/03/15 21:53), Lukas Slebodnik wrote:
>On (25/03/15 14:35), Pavel Reichl wrote:
>>
>>
>>On 03/25/2015 02:21 PM, Lukas Slebodnik wrote:
>>>On (25/03/15 14:05), Pavel Reichl wrote:
>>>>
>>>>On 03/25/2015 01:51 PM, Lukas Slebodnik wrote:
>>>>>On (25/03/15 12:01), Pavel Reichl wrote:
>>>>>>Hello please see attached patch.
>>>>>>
>>>>>>The need for this patch was discussed in thread: SDAP: Lock out ssh keys when
>>>>>>account naturally expires
>>>>>>This patch implements point number 3.
>>>>>>
>>>>>>>>I would prefer if we didn't add a new option as well, but since we
>>>>>>>>released
>>>>>>>>a version that only supported the lockout and not any other semantics,
>>>>>>>>I don't think we can get away with just changing the functionality. A
>>>>>>>>minor version can break functionality. But a major version can
>>>>>>>>
>>>>>>>>So I propose the following:
>>>>>>>>1) Add a new value for ldap_access_order called "ppolicy" that would
>>>>>>>>evaluate the pwdAccountLockedTime fully, including the new
>>>>>>>>functionality in this patchset
>>>>>>>>2) In 1.12, deprecate the "lockout" option and log a warning that it
>>>>>>>>will be removed in future relase and users should migrate to "ppolicy"
>>>>>>>>option
>>>>>The feature was introduced in sssd-1.12.1 and deprecated in sssd-1.12.5
>>>>>That's really fast progres. The deprecating the features
>>>>>after half a year.
>>>>>
>>>>>Could someone exaplain me why do we need to do such ritual dances?
>>>>>
>>>>>LS
>>>>First there was user ho wanted lockout functionality that is being dropped
>>>>now. https://fedorahosted.org/sssd/ticket/2364
>>>>
>>>>Then a few months later there came another user with
>>>>https://fedorahosted.org/sssd/ticket/2534 who wished to do something similar
>>>>but different.
>>>>
>I checked bugzilla tickets and the same user requested both features.
>
>>>>We think that user case addressed in 1st ticket can be handled by
>>>>functionality introduced for 2nd ticket.
>>>>
>>>I mentioned it as a part of review a month ago.
>>>So you needn't explain it to me.
>>I'm sorry then.
>>>
>>>>So we decided to drop functionality for the first patch.  Is it clear now?
>>>>
>>>The only think which I do not understand is why do we need to drop it know
>>>and it could not be part of ticket #2534
>>It is my understanding we could not drop the functionality in 1.12 - as there
>>are users who use it - so we needed to keep both.
>>
>>But I think you are right that we could drop it in master as part of #2534.
>>Might be you remember that we were on tight schedule then and we simply
>>forget to this extra work for master.
>>Now QE reminded us a created a BZ.
>BZ1205604 says:
>  Expected results:
>  Only ppolicy works since it is stricter than lockout
>
>So your patch is wrong and we need to drop functionality even in 1.12
>
>NACK
I'm sorry I sent NACK to the wrong patch.
It should have been to patch
    "LDAP: warn about lockout option being deprecated"
LS



More information about the sssd-devel mailing list