mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-23 23:50:03 -06:00
f347c3f230
Add support for bind grace limiting per https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-06 389-ds provides for alternative naming than the draft, using those instead: passwordGraceUserTime for pwdGraceUserTime and passwordGraceLimit for pwdGraceLoginLimit. passwordGraceLimit is a policy variable that an administrator sets to determine the maximum number of LDAP binds allowed when a password is marked as expired. This is suported for both the global and per-group password policies. passwordGraceUserTime is a count per-user of the number of binds. When the passwordGraceUserTime exceeds the passwordGraceLimit then all subsequent binds will be denied and an administrator will need to reset the user password. If passwordGraceLimit is less than 0 then grace limiting is disabled and unlimited binds are allowed. Grace login limitations only apply to entries with the objectclass posixAccount or simplesecurityobject in order to limit this to IPA users and system accounts. Some basic support for the LDAP ppolicy control is enabled such that if the ppolicy control is in the bind request then the number of remaining grace binds will be returned with the request. The passwordGraceUserTime attribute is reset to 0 upon a password reset. user-status has been extended to display the number of grace binds which is stored centrally and not per-server. Note that passwordGraceUserTime is an operational attribute. https://pagure.io/freeipa/issue/1539 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> |
||
|---|---|---|
| .. | ||
| plugins | ||
| server | ||
| __init__.py | ||
| adtrust.py | ||
| adtrustinstance.py | ||
| bindinstance.py | ||
| ca.py | ||
| cainstance.py | ||
| certs.py | ||
| conncheck.py | ||
| custodiainstance.py | ||
| dns.py | ||
| dnskeysyncinstance.py | ||
| dogtag.py | ||
| dogtaginstance.py | ||
| dsinstance.py | ||
| httpinstance.py | ||
| installutils.py | ||
| ipa_acme_manage.py | ||
| ipa_backup.py | ||
| ipa_cacert_manage.py | ||
| ipa_cert_fix.py | ||
| ipa_crlgen_manage.py | ||
| ipa_kra_install.py | ||
| ipa_ldap_updater.py | ||
| ipa_otptoken_import.py | ||
| ipa_pkinit_manage.py | ||
| ipa_replica_install.py | ||
| ipa_restore.py | ||
| ipa_server_certinstall.py | ||
| ipa_server_install.py | ||
| ipa_server_upgrade.py | ||
| ipa_subids.py | ||
| ipa_trust_enable_agent.py | ||
| ipa_winsync_migrate.py | ||
| ipactl.py | ||
| kra.py | ||
| krainstance.py | ||
| krbinstance.py | ||
| ldapupdate.py | ||
| odsexporterinstance.py | ||
| opendnssecinstance.py | ||
| otpdinstance.py | ||
| replication.py | ||
| schemaupdate.py | ||
| service.py | ||
| sysupgrade.py | ||
| upgradeinstance.py | ||