Le mardi 18 juin 2019, 12:36:56 CEST Quanah Gibson-Mount a écrit :
> So, there is no way to filter on shadowExpire values which are
> today's timestamp?
shadowExpire is defined as an integer type, not as a timestamp, so no.
> It sounds crazy that such basic needs are not covered by LDAP protocol,
> have I missed something?
It's not clear to me what this has to do with the LDAP protocol. The
definition of the "expire" field from /etc/shadow is:
Expire : days since Jan 1, 1970 that account is disabled i.e. an absolute
date specifying when the login may no longer be used.
So it's an integer (just as the RFC defines it). I would imagine you could
write something that converts a current timestamp into the number of days,
etc, and then perform a search.
Yeah this is what I was calling timestamp sorry, getting the integer for today is easy,
but it seems there is no way for writing a search filter with greater-than or lesser-than
for this attribute.
It has to do with the LDAP protocol that LDAP lets schema define attributes in ways that
forbid substring and range filters. We should be able to use extensible filters for these,
and specify which ordering or substring rule we want to see used.
And if attributes using integer syntax were to default to integerOrdering when not
specified, that would seem more sane.