|
 |
c1e7f29 |
Treat 'nsAccountLock: true' the same as 'loginDisabled: true'. Updated from
|
|
|
c1e7f29 |
original version filed as RT#5891.
|
|
|
c1e7f29 |
|
|
|
c1e7f29 |
diff -up krb5-1.7/src/aclocal.m4 krb5-1.7/src/aclocal.m4
|
|
|
c1e7f29 |
--- krb5-1.7/src/aclocal.m4 2009-06-04 14:38:07.000000000 -0400
|
|
|
c1e7f29 |
+++ krb5-1.7/src/aclocal.m4 2009-06-04 14:38:07.000000000 -0400
|
|
|
c1e7f29 |
@@ -1746,6 +1746,12 @@ AC_ARG_WITH([edirectory],
|
|
|
c1e7f29 |
yes | no) ;;
|
|
|
c1e7f29 |
*) AC_MSG_ERROR(Invalid option value --with-edirectory="$withval") ;;
|
|
|
c1e7f29 |
esac], with_edirectory=no)dnl
|
|
|
c1e7f29 |
+AC_ARG_WITH([dirsrv],
|
|
|
c1e7f29 |
+[ --with-dirsrv compile 389/Red Hat/Fedora/Netscape Directory Server database backend module],
|
|
|
c1e7f29 |
+[case "$withval" in
|
|
|
c1e7f29 |
+ yes | no) ;;
|
|
|
c1e7f29 |
+ *) AC_MSG_ERROR(Invalid option value --with-dirsrv="$withval") ;;
|
|
|
c1e7f29 |
+esac], with_dirsrv=no)dnl
|
|
|
c1e7f29 |
|
|
|
c1e7f29 |
if test $with_ldap = yes; then
|
|
|
c1e7f29 |
if test $with_edirectory = yes; then
|
|
|
c1e7f29 |
@@ -1757,6 +1763,10 @@ elif test $with_edirectory = yes; then
|
|
|
c1e7f29 |
AC_MSG_NOTICE(enabling eDirectory database backend module support)
|
|
|
c1e7f29 |
OPENLDAP_PLUGIN=yes
|
|
|
c1e7f29 |
AC_DEFINE(HAVE_EDIRECTORY,1,[Define if LDAP KDB interface should assume eDirectory.])
|
|
|
c1e7f29 |
+elif test $with_dirsrv = yes; then
|
|
|
c1e7f29 |
+ AC_MSG_NOTICE(enabling 389/Red Hat/Fedora/Netscape Directory Server database backend module support)
|
|
|
c1e7f29 |
+ OPENLDAP_PLUGIN=yes
|
|
|
c1e7f29 |
+ AC_DEFINE(HAVE_DIRSRV,1,[Define if LDAP KDB interface should assume RHDS/FDS/NDS.])
|
|
|
c1e7f29 |
else
|
|
|
c1e7f29 |
: # neither enabled
|
|
|
c1e7f29 |
dnl AC_MSG_NOTICE(disabling ldap backend module support)
|
|
|
c1e7f29 |
diff -up krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
|
|
|
c1e7f29 |
--- krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c 2009-02-18 13:14:48.000000000 -0500
|
|
|
c1e7f29 |
+++ krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c 2009-06-04 14:38:07.000000000 -0400
|
|
|
c1e7f29 |
@@ -2157,6 +2157,22 @@ populate_krb5_db_entry (krb5_context con
|
|
|
c1e7f29 |
}
|
|
|
c1e7f29 |
}
|
|
|
c1e7f29 |
#endif
|
|
|
c1e7f29 |
+#ifdef HAVE_DIRSRV
|
|
|
c1e7f29 |
+ {
|
|
|
c1e7f29 |
+ krb5_timestamp expiretime=0;
|
|
|
c1e7f29 |
+ char *is_login_disabled=NULL;
|
|
|
c1e7f29 |
+
|
|
|
c1e7f29 |
+ /* LOGIN DISABLED */
|
|
|
c1e7f29 |
+ if ((st=krb5_ldap_get_string(ld, ent, "nsaccountlock", &is_login_disabled,
|
|
|
c1e7f29 |
+ &attr_present)) != 0)
|
|
|
c1e7f29 |
+ goto cleanup;
|
|
|
c1e7f29 |
+ if (attr_present == TRUE) {
|
|
|
c1e7f29 |
+ if (strcasecmp(is_login_disabled, "TRUE")== 0)
|
|
|
c1e7f29 |
+ entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
|
|
|
c1e7f29 |
+ free (is_login_disabled);
|
|
|
c1e7f29 |
+ }
|
|
|
c1e7f29 |
+ }
|
|
|
c1e7f29 |
+#endif
|
|
|
c1e7f29 |
|
|
|
c1e7f29 |
if ((st=krb5_read_tkt_policy (context, ldap_context, entry, tktpolname)) !=0)
|
|
|
c1e7f29 |
goto cleanup;
|
|
|
c1e7f29 |
diff -up krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
|
|
|
c1e7f29 |
--- krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c 2009-04-14 17:07:34.000000000 -0400
|
|
|
c1e7f29 |
+++ krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c 2009-06-04 14:38:07.000000000 -0400
|
|
|
c1e7f29 |
@@ -58,6 +58,9 @@ char *principal_attributes[] = { "kr
|
|
|
c1e7f29 |
"loginexpirationtime",
|
|
|
c1e7f29 |
"logindisabled",
|
|
|
c1e7f29 |
#endif
|
|
|
c1e7f29 |
+#ifdef HAVE_DIRSRV
|
|
|
c1e7f29 |
+ "nsaccountlock",
|
|
|
c1e7f29 |
+#endif
|
|
|
c1e7f29 |
"krbLastPwdChange",
|
|
|
c1e7f29 |
"krbExtraData",
|
|
|
c1e7f29 |
"krbObjectReferences",
|