Age | Commit message (Collapse) | Author | Files | Lines |
|
|
|
New experimental features should have their own configure switch to
enable or disable them at compile time. Additionally they can check if
the configure variable build_all_experimental_features is set and enable
the feature. This variable will be set if the command line option
--enable-all-experimental-features is used to configure sssd. This will
make it easy to enable all experimental features.
Experimental features should be marked in the man pages. To simplify
this include/experimental.xml can be used.
|
|
By default, we will treat the presence of any DENY rule as denying
all users. This option will allow the admin to explicitly ignore
DENY rules during a transitional period.
|
|
This option describes the time between refreshes of the HBAC rules
on the IPA server.
|
|
|
|
|
|
|
|
Instead of issuing N LDAP requests when processing a group with N users,
utilize the dereference functionality to pull down all the members in a
single LDAP request.
https://fedorahosted.org/sssd/ticket/799
|
|
https://fedorahosted.org/sssd/ticket/742
|
|
https://fedorahosted.org/sssd/ticket/551
|
|
https://fedorahosted.org/sssd/ticket/742
|
|
|
|
|
|
|
|
https://fedorahosted.org/sssd/ticket/700
|
|
https://fedorahosted.org/sssd/ticket/647
|
|
https://fedorahosted.org/sssd/ticket/746
|
|
|
|
|
|
https://fedorahosted.org/sssd/ticket/807
|
|
In some automatic build environments the lists of translated man pages
were not generated properly because ls put multiple file names into a
single single.
|
|
|
|
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
|
|
|
Earlier patch for strings was incomplete
|
|
|
|
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
|
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
|
|
|
|
|
The attribute nsAccountLock is used by RHDS, IPA and other directory
servers to indicate that the account is locked.
|
|
The second bit of userAccountControl is used to determine if the account
is enabled or disabled. accountExpires is checked to see if the account
is expired.
|
|
|
|
|
|
|
|
Fixed several typos
|
|
|
|
|
|
|
|
Also adds an option to limit how often we check the ID provider,
so that conversations with multiple PAM requests won't update the
cache multiple times.
https://fedorahosted.org/sssd/ticket/749
|
|
Translated a couple of strings from manpages into Czech. Makes the
manpage translation patch testable.
|
|
Utilizes PO4A to extract translatable strings from Docbook XML sources
and allows translators to submit ordinary .PO files. PO4A then generates
translated Docbook documents that can be used to generate translated end
user documentation.
https://fedorahosted.org/sssd/ticket/297
|
|
https://fedorahosted.org/sssd/ticket/670
|
|
Previously, we would wait for ten seconds before starting an
enumeration. However, this meant that on the first startup (before
we had run our first enumeration) there was a ten-second window
where clients would immediately get back a response with no
entries instead of blocking until the enumeration completed.
With this patch, SSSD will now run an enumeration immediately upon
startup. Further startups will retain the ten-second delay so as
not to slow down system bootups.
https://fedorahosted.org/sssd/ticket/616
|
|
This patch adds simple_allow_groups and simple_deny_groups options
to the simple access provider. It makes it possible to grant or
deny access based on a user's group memberships within the domain.
This patch makes one minor change to previous functionality: now
all deny rules will supersede allow rules. Previously, if both
simple_allow_users and simple_deny_users were set with the same
value, the allow would win.
https://fedorahosted.org/sssd/ticket/440
|
|
|
|
|
|
|
|
|
|
Two new options are added to the LDAP access provider to allow a broader
range of access control rules to be evaluated.
'ldap_access_order' makes it possible to run more than one rule. To keep
compatibility with older versions the default is 'filter'. This patch
adds a new rule 'expire'.
'ldap_account_expire_policy' specifies which LDAP attribute should be
used to determine if an account is expired or not. Currently only
'shadow' is supported which evaluates the ldap_user_shadow_expire
attribute.
|