Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
--On Monday, January 02, 2017 2:40 PM +0100 Matthieu Cerda matthieu.cerda@nbs-system.com wrote:
Thank you very much Quanah !
Do you think adding a note about mandatory rootdn setting in slapo-ppolicy manpage would be a worthy contribution ? (I'll gladly submit a patch)
Hi Matthieu,
It's already currently noted in the 3rd paragraph of the man page:
Note that some of the policies do not take effect when the operation is performed with the rootdn identity; all the operations, when performed with any other identity, may be subjected to constraints, like access control.
Note the bit about "all the operations, ..."
If you think of a way to reword it that you feel is a better explanation, that could certainly be considered. :)
Regards, Quanah
--
Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com
Quanah Gibson-Mount quanah@symas.com schrieb am 03.01.2017 um 00:11 in
Nachricht <F365AC223D2A1E22A5345243@[192.168.1.30]>:
--On Monday, January 02, 2017 2:40 PM +0100 Matthieu Cerda matthieu.cerda@nbs-system.com wrote:
Thank you very much Quanah !
Do you think adding a note about mandatory rootdn setting in slapo-ppolicy manpage would be a worthy contribution ? (I'll gladly submit a patch)
Hi Matthieu,
It's already currently noted in the 3rd paragraph of the man page:
Note that some of the policies do not take effect when the operationis performed with the rootdn identity; all the operations, when performed with any other identity, may be subjected to constraints, like access control.
Note the bit about "all the operations, ..."
If you think of a way to reword it that you feel is a better explanation, that could certainly be considered. :)
I think a notice who is the modifier on ppolicy changes would be woth it; specifically if it's related to RootDN ;-) I think I had already asked earlier about some notice on ACLs that ppolicy may or may not need to work.
Regards, Ulrich
Regards, Quanah
--
Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com
Le 03/01/2017 à 08:05, Ulrich Windl a écrit :
Quanah Gibson-Mount quanah@symas.com schrieb am 03.01.2017 um 00:11 in
Nachricht <F365AC223D2A1E22A5345243@[192.168.1.30]>:
(...)
Note the bit about "all the operations, ..."
If you think of a way to reword it that you feel is a better explanation, that could certainly be considered. :)
I think a notice who is the modifier on ppolicy changes would be woth it; specifically if it's related to RootDN ;-) I think I had already asked earlier about some notice on ACLs that ppolicy may or may not need to work.
Well I certainly didn't understand the message as 'every operation will be done assuming the rootdn identity' indeed.
I agree with Ulrich, maybe a small note in the manpage saying exactly that might help, just in case ?
Here is a proposal patch on slapo-ppolicy.5 manpage to clarify that.
Thanks in advance,
openldap-technical@openldap.org
-
Matthieu Cerda -
Quanah Gibson-Mount -
Ulrich Windl