Better cleanup task handling

Implements a different mechanism for cleanup task. Instead of just
deleting expired entries, this patch adds a new option
account_cache_expiration for domains. If an entry is expired and the last
login was more days in the past that account_cache_expiration, the entry is
deleted.

Groups are deleted if they are expired and and no user references them
(no user has memberof: attribute pointing at that group).

The parameter account_cache_expiration is not LDAP-specific, so that other
future backends might use the same timeout setting.

Fixes: #391

1 files changed, 1 insertions, 0 deletions

diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 16dbb7843..007185fc3 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -142,6 +142,7 @@ enum sdap_basic_opt {
     SDAP_KRB5_REALM,
     SDAP_PWD_POLICY,
     SDAP_REFERRALS,
+    SDAP_ACCOUNT_CACHE_EXPIRATION,
 
     SDAP_OPTS_BASIC /* opts counter */
 };