From 22f4c1b86dcf5589e63f2ae043dc65a8f72f6f18 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 21 Dec 2010 13:30:33 +0100 Subject: Add LDAP expire policy based on AD attributes The second bit of userAccountControl is used to determine if the account is enabled or disabled. accountExpires is checked to see if the account is expired. --- src/config/etc/sssd.api.d/sssd-ldap.conf | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src/config/etc/sssd.api.d/sssd-ldap.conf') diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf index 8aaecd5db..064438316 100644 --- a/src/config/etc/sssd.api.d/sssd-ldap.conf +++ b/src/config/etc/sssd.api.d/sssd-ldap.conf @@ -58,6 +58,8 @@ ldap_user_krb_last_pwd_change = str, None, false ldap_user_krb_password_expiration = str, None, false ldap_user_authorized_service = str, None, false ldap_pwd_attribute = str, None, false +ldap_user_ad_account_expires = str, None, false +ldap_user_ad_user_account_control = str, None, false ldap_group_search_base = str, None, false ldap_group_search_scope = str, None, false ldap_group_search_filter = str, None, false -- cgit