[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Antw: Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs



--On Tuesday, January 03, 2017 2:49 PM +0100 Matthieu Cerda <matthieu.cerda@nbs-system.com> wrote:



Le 03/01/2017 à 08:05, Ulrich Windl a écrit :
Quanah Gibson-Mount <quanah@symas.com> schrieb am 03.01.2017 um 00:11
in
Nachricht <F365AC223D2A1E22A5345243@[192.168.1.30]>:
(...)

Note the bit about "all the operations, ..."

If you think of a way to reword it that you feel is a better
explanation,  that could certainly be considered. :)

I think a notice who is the modifier on ppolicy changes would be woth
it; specifically if it's related to RootDN ;-) I think I had already
asked earlier about some notice on ACLs that ppolicy may or may not need
to work.

Well I certainly didn't understand the message as 'every operation will
be done assuming the rootdn identity' indeed.

I agree with Ulrich, maybe a small note in the manpage saying exactly
that might help, just in case ?

Here is a proposal patch on slapo-ppolicy.5 manpage to clarify that.

Submissions need to be via the ITS system, http://www.openldap.org/its/

Thanks,
Quanah


--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>