[SSSD] [PATCH] LDAP: warn about lockout option being deprecated

Jakub Hrozek jhrozek at redhat.com
Mon May 11 17:28:16 UTC 2015


On Mon, May 11, 2015 at 02:35:35PM +0200, Pavel Reichl wrote:
> On 05/11/2015 12:24 PM, Jakub Hrozek wrote:
> >On Wed, Mar 25, 2015 at 10:19:39AM +0100, Pavel Reichl wrote:
> >>Hello,
> >>
> >>attached patch deprecates lockout option in 1-12 branch.
> >>
> >>This was discussed in thread: SDAP: Lock out ssh keys when account naturally expires
> >>This patch implements point number 2.
> >>
> >>>>I would prefer if we didn't add a new option as well, but since we released
> >>>>a version that only supported the lockout and not any other semantics,
> >>>>I don't think we can get away with just changing the functionality. A
> >>>>minor version can break functionality. But a major version can
> >>>>
> >>>>So I propose the following:
> >>>>1) Add a new value for ldap_access_order called "ppolicy" that would
> >>>>evaluate the pwdAccountLockedTime fully, including the new
> >>>>functionality in this patchset
> >>>>2) In 1.12, deprecate the "lockout" option and log a warning that it
> >>>>will be removed in future relase and users should migrate to "ppolicy"
> >>>>option
> >>>>3) In master (1.13), remove the "lockout" ldap_access_order value
> >>I'll send patch for point number 3 in separate thread.
> >>
> >>Thanks!
> >I'm sorry it took so long to get back to this patch.
> >
> >> From 3adee0c2ff207eef7c2edcfed80eb47754570210 Mon Sep 17 00:00:00 2001
> >>From: Pavel Reichl <preichl at redhat.com>
> >>Date: Wed, 25 Mar 2015 05:03:12 -0400
> >>Subject: [PATCH] LDAP: warn about lockout option being deprecated
> >>
> >>---
> >>  src/man/sssd-ldap.5.xml          | 7 +++++++
> >>  src/providers/ldap/sdap_access.c | 9 ++++++++-
> >>  2 files changed, 15 insertions(+), 1 deletion(-)
> >>
> >>diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
> >>index 00da3964af7619f19525e76c4f1292586dd60f54..b46e07fec96ffa7305ab41ce42c16b2e94e53292 100644
> >>--- a/src/man/sssd-ldap.5.xml
> >>+++ b/src/man/sssd-ldap.5.xml
> >>@@ -1955,6 +1955,13 @@ ldap_access_filter = (employeeType=admin)
> >>                              be set for this feature to work.
> >>                          </para>
> >>                          <para>
> >>+                            <emphasis>
> >>+                            Please note that this option is superseded by
> >>+                            ppolicy option and will be dropped in next major
> >>+                            release.
> >Since we can't remove the option soon, I'd say "might be removed in a
> >future release". It would also be nice to point the admin to the option
> >he should be using now instead.
> OK, I mentioned ppolicy option for the second time, or did you just want me
> to rephrase the sentence?

Ah, sorry, no. I was reading the rendered text and didn't realize
ppolicy was an option and not a generic term. Sorry, can you remove the
added sentence adn then just enclose ppolicy in <quote> ? That would
make the rendering better readable I guess. Also, "the ppolicy option".



More information about the sssd-devel mailing list