<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'><span style="color: rgb(51, 102, 255);">Jakub,<br><br>It's fine, I just noticed something else that needs to change too. So here's an update and the parameter cases squashed. I'll make sure I can compile the build next time before committing. </span><br><br>From 08e0255977e008807a0ff2b34bf10ca5c61ee89f Mon Sep 17 00:00:00 2001<br>From: Dan Lavu <dlavu@redhat.com><br>Date: Thu, 9 Oct 2014 08:56:35 -0400<br>Subject: [PATCH] Updated the sssd-ldap man page.<br><br>To address https://fedorahosted.org/sssd/ticket/2451 ,<br>added a note to the section and a full configuration<br>example at the bottom of the man page.<br>---<br> src/man/sssd-ldap.5.xml | 24 +++++++++++++++++++++++-<br> 1 file changed, 23 insertions(+), 1 deletion(-)<br><br>diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml<br>index 03ea7948b69ed28945fc614eee5c47195cd85937..32c4cf86b71c8e75d1d754f870f44239fc24cd2d 100644<br>--- a/src/man/sssd-ldap.5.xml<br>+++ b/src/man/sssd-ldap.5.xml<br>@@ -1941,7 +1941,8 @@ ldap_access_filter = (employeeType=admin)<br> </para><br> <para><br> Please note that it is a configuration error if a<br>- value is used more than once.<br>+ value is used more than once or 'access_provider = ldap'<br>+ is not used. <br> </para><br> </listitem><br> </varlistentry><br>@@ -2491,6 +2492,27 @@ ldap_access_filter = (employeeType=admin)<br> </programlisting><br> </para><br> </refsect1><br>+ <refsect1 id='ldap_access_filter_example'><br>+ <title>LDAP ACCESS FILTER EXAMPLE</title><br>+ <para><br>+ The following example assumes that SSSD is correctly<br>+ configured and to use the ldap_access_order=lockout. <br>+ </para><br>+ <para><br>+<programlisting><br>+ [domain/LDAP]<br>+ id_provider = ldap<br>+ auth_provider = ldap<br>+ access_provider = ldap<br>+ ldap_access_order = lockout<br>+ ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=mydomain,dc=org <br>+ ldap_uri = ldap://ldap.mydomain.org<br>+ ldap_search_base = dc=mydomain,dc=org<br>+ ldap_tls_reqcert = demand<br>+ cache_credentials = true<br>+</programlisting><br>+ </para><br>+ </refsect1><br> <br> <refsect1 id='notes'><br> <title>NOTES</title><br>-- <br>1.9.3<br><br><br><hr id="zwchr"><div style="color: rgb(0, 0, 0); font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>From: </b>"Jakub Hrozek" <jhrozek@redhat.com><br><b>To: </b>sssd-devel@lists.fedorahosted.org<br><b>Sent: </b>Thursday, October 9, 2014 11:29:03 AM<br><b>Subject: </b>Re: [SSSD] Here is a patch for sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout'<br><br>On Thu, Oct 09, 2014 at 09:38:54AM -0400, Dan Lavu wrote:<br>> https://fedorahosted.org/sssd/ticket/2451<br>> <br>> Added a line in the notes and a full example at the bottom.<br><br>> From 7678b7919e8f06176082d506885b8f85c4120c93 Mon Sep 17 00:00:00 2001<br>> From: Dan Lavu <dlavu@redhat.com><br>> Date: Thu, 9 Oct 2014 08:56:35 -0400<br>> Subject: [PATCH] Updated the sssd-ldap man page.<br>> <br>> To address https://fedorahosted.org/sssd/ticket/2451 ,<br>> added a note to the section and a full configuration<br>> example at the bottom of the man page.<br>> ---<br>> src/man/sssd-ldap.5.xml | 24 +++++++++++++++++++++++-<br>> 1 file changed, 23 insertions(+), 1 deletion(-)<br>> <br>> diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml<br>> index 03ea7948b69ed28945fc614eee5c47195cd85937..15902aa9fd94c21d01db7fbce5699b6afb761be5 100644<br>> --- a/src/man/sssd-ldap.5.xml<br>> +++ b/src/man/sssd-ldap.5.xml<br>> @@ -1941,7 +1941,8 @@ ldap_access_filter = (employeeType=admin)<br>> </para><br>> <para><br>> Please note that it is a configuration error if a<br>> - value is used more than once.<br>> + value is used more than once or 'access_provider = ldap'<br>> + is not used. <br>> </para><br>> </listitem><br>> </varlistentry><br>> @@ -2491,6 +2492,27 @@ ldap_access_filter = (employeeType=admin)<br>> </programlisting><br>> </para><br>> </refsect1><br>> + <refsect1 id='ldap_access_filter example'><br><br>I don't think you can use a space in the id element. With this patch, I<br>get a build error:<br>/home/remote/jhrozek/devel/sssd/src/man/sssd-ldap.5.xml:2495: element<br>refsect1: validity error : Syntax of value for attribute id of refsect1<br>is not valid<br><br>> + <title>LDAP ACCESS FILTER EXAMPLE</title><br>> + <para><br>> + The following example assumes that SSSD is correctly<br>> + configured and to use the ldap_access_order=lockout. <br>> + </para><br>> + <para><br>> +<programlisting><br>> + [domain/LDAP]<br>> + id_provider = ldap<br>> + auth_provider = ldap<br>> + access_provider = ldap<br>> + ldap_Access_order = lockout<br><br>A really minor issue, but I'd prefer if all parameters were lowercase.<br>OK if I squash in this single change and push?<br><br>> + ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=example,dc=com <br>> + ldap_uri = ldap://ldap.mydomain.org<br>> + ldap_search_base = dc=mydomain,dc=org<br>> + ldap_tls_reqcert = demand<br>> + cache_credentials = true<br>> +</programlisting><br>> + </para><br>> + </refsect1><br>> <br>> <refsect1 id='notes'><br>> <title>NOTES</title><br>> -- <br>> 1.9.3<br>> <br><br>> _______________________________________________<br>> sssd-devel mailing list<br>> sssd-devel@lists.fedorahosted.org<br>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel<br><br>_______________________________________________<br>sssd-devel mailing list<br>sssd-devel@lists.fedorahosted.org<br>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel<br></div><br></div></body></html>