<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style style="display: none;" id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body tabindex="0" aria-label="Message body" fpstyle="1" dir="ltr">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper" style="font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt; color: #000000; margin: 0">
Hello,<br>
I've searched extensively and haven't found an answer to this. I have a RHEL6.4 system running slapd version 2.4.23-32.el6_4.1 with sssd version 1.9.2-82.11.el6_4. I've configured OpenLDAP to use ppolicy. Everything (password expires, account locked,
grace periods, etc) is working beautifully if the user logs in with their password. But if they have an SSH public key, then even if the account in OpenLDAP is locked, the user can still login.<br>
I can't seem to find a FAQ on configuring OpenLDAP and SSSD in regards to ppolicy settings for this case. I hope I am just missing something simple. Any suggestions or pointers would be much appreciated.<br>
<br>
Thanks,<br>
-Brad Viviano<br>
<div>
<p><br>
</p>
<div style="font-family:Tahoma; font-size:13px"><font face="Tahoma" size="1">===================================================<br>
Brad Viviano<br>
High Performance Computing & Scientific Visualization<br>
Lockheed Martin, Supporting the EPA<br>
Research Triangle Park, NC<br>
919-541-2696<br>
<br>
HSCSS Task Order Lead - Ravi Nair<br>
919-541-5467 - Nair.Ravi@epa.gov<br>
High Performance Computing Subtask Lead - Durward Jones<br>
919-541-5043 - Jones.Durward@epa.gov<br>
Environmental Modeling and Visualization Lead - Heidi Paulsen<br>
919-541-1834 - Paulsen.Heidi@epa.gov</font></div>
</div>
</div>
</body>
</html>