[SSSD] [PATCH] LDAP: warn about lockout option being deprecated

Jakub Hrozek jhrozek at redhat.com
Mon May 11 10:24:34 UTC 2015


On Wed, Mar 25, 2015 at 10:19:39AM +0100, Pavel Reichl wrote:
> Hello,
> 
> attached patch deprecates lockout option in 1-12 branch.
> 
> This was discussed in thread: SDAP: Lock out ssh keys when account naturally expires
> This patch implements point number 2.
> 
> >>I would prefer if we didn't add a new option as well, but since we released
> >>a version that only supported the lockout and not any other semantics,
> >>I don't think we can get away with just changing the functionality. A
> >>minor version can break functionality. But a major version can
> >>
> >>So I propose the following:
> >>1) Add a new value for ldap_access_order called "ppolicy" that would
> >>evaluate the pwdAccountLockedTime fully, including the new
> >>functionality in this patchset
> >>2) In 1.12, deprecate the "lockout" option and log a warning that it
> >>will be removed in future relase and users should migrate to "ppolicy"
> >>option
> >>3) In master (1.13), remove the "lockout" ldap_access_order value
> I'll send patch for point number 3 in separate thread.
> 
> Thanks!

I'm sorry it took so long to get back to this patch.

> From 3adee0c2ff207eef7c2edcfed80eb47754570210 Mon Sep 17 00:00:00 2001
> From: Pavel Reichl <preichl at redhat.com>
> Date: Wed, 25 Mar 2015 05:03:12 -0400
> Subject: [PATCH] LDAP: warn about lockout option being deprecated
> 
> ---
>  src/man/sssd-ldap.5.xml          | 7 +++++++
>  src/providers/ldap/sdap_access.c | 9 ++++++++-
>  2 files changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
> index 00da3964af7619f19525e76c4f1292586dd60f54..b46e07fec96ffa7305ab41ce42c16b2e94e53292 100644
> --- a/src/man/sssd-ldap.5.xml
> +++ b/src/man/sssd-ldap.5.xml
> @@ -1955,6 +1955,13 @@ ldap_access_filter = (employeeType=admin)
>                              be set for this feature to work.
>                          </para>
>                          <para>
> +                            <emphasis>
> +                            Please note that this option is superseded by
> +                            ppolicy option and will be dropped in next major
> +                            release.

Since we can't remove the option soon, I'd say "might be removed in a
future release". It would also be nice to point the admin to the option
he should be using now instead.

> +                            </emphasis>
> +                        </para>
> +                        <para>
>                              <emphasis>ppolicy</emphasis>: use account locking.
>                              If set, this option denies access in case that ldap
>                              attribute 'pwdAccountLockedTime' is present and has
> diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
> index 0b251121335841b357e55deac608f50e24311285..cefd2a23887bef0250697c55235fa96fdb769ce2 100644
> --- a/src/providers/ldap/sdap_access.c
> +++ b/src/providers/ldap/sdap_access.c
> @@ -212,7 +212,13 @@ static errno_t sdap_access_check_next_rule(struct sdap_access_req_ctx *state,
>              /* we are done with no errors */
>              return EOK;
>  
> +        /* This option is deprecated by LDAP_ACCESS_PPOLICY */
>          case LDAP_ACCESS_LOCKOUT:
> +            DEBUG(SSSDBG_MINOR_FAILURE,
> +                  "WARNING %s option is deprecated and will be removed in "
> +                  "future release. Please migrate to %s option instead.\n",
> +                  LDAP_ACCESS_LOCK_NAME, LDAP_ACCESS_PPOLICY_NAME);

Same comment here.

> +
>              subreq = sdap_access_ppolicy_send(state, state->ev, state->be_ctx,
>                                                state->domain,
>                                                state->access_ctx,
> @@ -221,7 +227,8 @@ static errno_t sdap_access_check_next_rule(struct sdap_access_req_ctx *state,
>                                                state->user_entry,
>                                                PWP_LOCKOUT_ONLY);
>              if (subreq == NULL) {
> -                DEBUG(SSSDBG_CRIT_FAILURE, "sdap_access_ppolicy_send failed.\n");
> +                DEBUG(SSSDBG_CRIT_FAILURE,
> +                      "sdap_access_ppolicy_send failed.\n");
>                  return ENOMEM;
>              }
>  
> -- 
> 2.1.0
> 

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list