Add ipa_hbac_treat_deny_as option

By default, we will treat the presence of any DENY rule as denying
all users. This option will allow the admin to explicitly ignore
DENY rules during a transitional period.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index 26e13456d..f6e1d4e5b 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -51,6 +51,7 @@ enum ipa_basic_opt {
     IPA_HBAC_SEARCH_BASE,
     IPA_KRB5_REALM,
     IPA_HBAC_REFRESH,
+    IPA_HBAC_DENY_METHOD,
 
     IPA_OPTS_BASIC /* opts counter */
 };