| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
| |
There were inconsistencies between what sssd.conf manpage said
and what the code enforces.
|
| |
|
|
|
| |
When refactoring talloc_asprintf calls a check was left behind that
cased the backend to go offline immediately.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Implements a different mechanism for cleanup task. Instead of just
deleting expired entries, this patch adds a new option
account_cache_expiration for domains. If an entry is expired and the last
login was more days in the past that account_cache_expiration, the entry is
deleted.
Groups are deleted if they are expired and and no user references them
(no user has memberof: attribute pointing at that group).
The parameter account_cache_expiration is not LDAP-specific, so that other
future backends might use the same timeout setting.
Fixes: #391
|
| |
|
|
|
|
|
| |
Do not attempt to validate expired entries in cache, just delete them.
Also increase the cache timeouts.
Fixes: #331
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
So far we handled expired password during authentication. Other PAM
modules typically detect expired password during account management and
return PAM_NEW_AUTHTOK_REQD if the password is expired and should be
changed. The PAM library then calls the change password routines. To
meet these standards pam_sss is change accordingly.
As a result it is now possible to update an expired password via ssh if
sssd is running with PasswordAuthentication=yes. One drawback due to
limitations of PAM is that the user now has to type his current password
again before setting a new one.
|
|
|
Also update BUILD.txt
|
