|
 |
14f0285 |
From f7538a0621d6b593e31f2031570a6f4678940241 Mon Sep 17 00:00:00 2001
|
|
|
14f0285 |
From: Robbie Harwood <rharwood@redhat.com>
|
|
|
14f0285 |
Date: Tue, 23 Aug 2016 16:47:44 -0400
|
|
|
14f0285 |
Subject: [PATCH 08/19] krb5-1.13-dirsrv-accountlock.patch
|
|
|
14f0285 |
|
|
|
a89bdde |
Treat 'nsAccountLock: true' the same as 'loginDisabled: true'. Updated from
|
|
|
a89bdde |
original version filed as RT#5891.
|
|
|
14f0285 |
---
|
|
|
14f0285 |
src/aclocal.m4 | 9 +++++++++
|
|
|
14f0285 |
src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c | 17 +++++++++++++++++
|
|
|
14f0285 |
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c | 3 +++
|
|
|
14f0285 |
3 files changed, 29 insertions(+)
|
|
|
a89bdde |
|
|
|
14f0285 |
diff --git a/src/aclocal.m4 b/src/aclocal.m4
|
|
|
14f0285 |
index ed343c5..f67eef7 100644
|
|
|
14f0285 |
--- a/src/aclocal.m4
|
|
|
14f0285 |
+++ b/src/aclocal.m4
|
|
|
14f0285 |
@@ -1653,6 +1653,15 @@ if test "$with_ldap" = yes; then
|
|
|
a89bdde |
AC_MSG_NOTICE(enabling OpenLDAP database backend module support)
|
|
|
a89bdde |
OPENLDAP_PLUGIN=yes
|
|
|
a89bdde |
fi
|
|
|
a89bdde |
+AC_ARG_WITH([dirsrv-account-locking],
|
|
|
a89bdde |
+[ --with-dirsrv-account-locking compile 389/Red Hat/Fedora/Netscape Directory Server database backend module],
|
|
|
a89bdde |
+[case "$withval" in
|
|
|
a89bdde |
+ yes | no) ;;
|
|
|
a89bdde |
+ *) AC_MSG_ERROR(Invalid option value --with-dirsrv-account-locking="$withval") ;;
|
|
|
a89bdde |
+esac], with_dirsrv_account_locking=no)
|
|
|
a89bdde |
+if test $with_dirsrv_account_locking = yes; then
|
|
|
a89bdde |
+ AC_DEFINE(HAVE_DIRSRV_ACCOUNT_LOCKING,1,[Define if LDAP KDB interface should heed 389 DS's nsAccountLock attribute.])
|
|
|
a89bdde |
+fi
|
|
|
a89bdde |
])dnl
|
|
|
a89bdde |
dnl
|
|
|
a89bdde |
dnl If libkeyutils exists (on Linux) include it and use keyring ccache
|
|
|
14f0285 |
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
|
|
|
14f0285 |
index aca8f31..0a0968c 100644
|
|
|
14f0285 |
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
|
|
|
14f0285 |
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
|
|
|
14f0285 |
@@ -1545,6 +1545,23 @@ populate_krb5_db_entry(krb5_context context, krb5_ldap_context *ldap_context,
|
|
|
a89bdde |
ret = krb5_dbe_update_tl_data(context, entry, &userinfo_tl_data);
|
|
|
a89bdde |
if (ret)
|
|
|
a89bdde |
goto cleanup;
|
|
|
a89bdde |
+#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING
|
|
|
a89bdde |
+ {
|
|
|
a89bdde |
+ krb5_timestamp expiretime=0;
|
|
|
a89bdde |
+ char *is_login_disabled=NULL;
|
|
|
a89bdde |
+
|
|
|
a89bdde |
+ /* LOGIN DISABLED */
|
|
|
a89bdde |
+ ret = krb5_ldap_get_string(ld, ent, "nsAccountLock", &is_login_disabled,
|
|
|
a89bdde |
+ &attr_present);
|
|
|
a89bdde |
+ if (ret)
|
|
|
a89bdde |
+ goto cleanup;
|
|
|
a89bdde |
+ if (attr_present == TRUE) {
|
|
|
a89bdde |
+ if (strcasecmp(is_login_disabled, "TRUE")== 0)
|
|
|
a89bdde |
+ entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
|
|
|
a89bdde |
+ free (is_login_disabled);
|
|
|
a89bdde |
+ }
|
|
|
a89bdde |
+ }
|
|
|
a89bdde |
+#endif
|
|
|
a89bdde |
|
|
|
a89bdde |
ret = krb5_read_tkt_policy(context, ldap_context, entry, tktpolname);
|
|
|
a89bdde |
if (ret)
|
|
|
14f0285 |
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
|
|
|
14f0285 |
index 6a06f55..1f87e21 100644
|
|
|
14f0285 |
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
|
|
|
14f0285 |
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
|
|
|
14f0285 |
@@ -54,6 +54,9 @@ char *principal_attributes[] = { "krbprincipalname",
|
|
|
a89bdde |
"krbLastFailedAuth",
|
|
|
a89bdde |
"krbLoginFailedCount",
|
|
|
a89bdde |
"krbLastSuccessfulAuth",
|
|
|
a89bdde |
+#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING
|
|
|
a89bdde |
+ "nsAccountLock",
|
|
|
a89bdde |
+#endif
|
|
|
a89bdde |
"krbLastPwdChange",
|
|
|
a89bdde |
"krbLastAdminUnlock",
|
|
|
a89bdde |
"krbExtraData",
|
|
|
14f0285 |
--
|
|
|
14f0285 |
2.9.3
|
|
|
14f0285 |
|