From 22f4c1b86dcf5589e63f2ae043dc65a8f72f6f18 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 21 Dec 2010 13:30:33 +0100 Subject: Add LDAP expire policy based on AD attributes The second bit of userAccountControl is used to determine if the account is enabled or disabled. accountExpires is checked to see if the account is expired. --- src/providers/ldap/ldap_init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/providers/ldap/ldap_init.c') diff --git a/src/providers/ldap/ldap_init.c b/src/providers/ldap/ldap_init.c index d5dad360..61f92333 100644 --- a/src/providers/ldap/ldap_init.c +++ b/src/providers/ldap/ldap_init.c @@ -345,7 +345,8 @@ int sssm_ldap_access_init(struct be_ctx *bectx, "but no ldap_account_expire_policy configured. " "All domain users will be denied access.\n")); } else { - if (strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_SHADOW) != 0) { + if (strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_SHADOW) != 0 && + strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_AD) != 0) { DEBUG(1, ("Unsupported LDAP account expire policy [%s].\n", dummy)); ret = EINVAL; -- cgit