<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 03/25/2015 12:01 PM, Pavel Reichl wrote:<br>
<blockquote cite="mid:55129572.6060009@redhat.com" type="cite">Hello
please see attached patch.
<br>
<br>
The need for this patch was discussed in thread: SDAP: Lock out
ssh keys when account naturally expires
<br>
This patch implements point number 3.
<br>
<br>
<blockquote type="cite">
<blockquote type="cite">I would prefer if we didn't add a new
option as well, but since we released
<br>
a version that only supported the lockout and not any other
semantics,
<br>
I don't think we can get away with just changing the
functionality. A
<br>
minor version can break functionality. But a major version can
<br>
<br>
So I propose the following:
<br>
1) Add a new value for ldap_access_order called "ppolicy" that
would
<br>
evaluate the pwdAccountLockedTime fully, including the new
<br>
functionality in this patchset
<br>
2) In 1.12, deprecate the "lockout" option and log a warning
that it
<br>
will be removed in future relase and users should migrate to
"ppolicy"
<br>
option
<br>
3) In master (1.13), remove the "lockout" ldap_access_order
value
<br>
</blockquote>
</blockquote>
<br>
Thanks!
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
sssd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
</blockquote>
Hello,<br>
<br>
I think that it was decided that we won't push these patches. So
unless there are any more comments, please consider this thread to
be closed.<br>
<br>
Thanks!<br>
</body>
</html>