From 379f28cb47b1e3f6b26e405776e5bac3a91aad80 Mon Sep 17 00:00:00 2001
From: Nalin Dahyabhai <nalin@fedoraproject.org>
Date: Thu, 4 Jun 2009 19:38:46 +0000
Subject: [PATCH] - also treat "nsAccountLock: TRUE" in directory entries as an
 indication of     an account having been disabled

---
 krb5-1.7-dirsrv-accountlock.patch | 69 +++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 krb5-1.7-dirsrv-accountlock.patch

diff --git a/krb5-1.7-dirsrv-accountlock.patch b/krb5-1.7-dirsrv-accountlock.patch
new file mode 100644
index 0000000..1bb6ae4
--- /dev/null
+++ b/krb5-1.7-dirsrv-accountlock.patch
@@ -0,0 +1,69 @@
+Treat 'nsAccountLock: true' the same as 'loginDisabled: true'.  Updated from
+original version filed as RT#5891.
+
+diff -up krb5-1.7/src/aclocal.m4 krb5-1.7/src/aclocal.m4
+--- krb5-1.7/src/aclocal.m4	2009-06-04 14:38:07.000000000 -0400
++++ krb5-1.7/src/aclocal.m4	2009-06-04 14:38:07.000000000 -0400
+@@ -1746,6 +1746,12 @@ AC_ARG_WITH([edirectory],
+     yes | no) ;;
+     *)  AC_MSG_ERROR(Invalid option value --with-edirectory="$withval") ;;
+ esac], with_edirectory=no)dnl
++AC_ARG_WITH([dirsrv],
++[  --with-dirsrv       compile 389/Red Hat/Fedora/Netscape Directory Server database backend module],
++[case "$withval" in
++    yes | no) ;;
++    *)  AC_MSG_ERROR(Invalid option value --with-dirsrv="$withval") ;;
++esac], with_dirsrv=no)dnl
+ 
+ if test $with_ldap = yes; then
+   if test $with_edirectory = yes; then
+@@ -1757,6 +1763,10 @@ elif test $with_edirectory = yes; then
+   AC_MSG_NOTICE(enabling eDirectory database backend module support)
+   OPENLDAP_PLUGIN=yes
+   AC_DEFINE(HAVE_EDIRECTORY,1,[Define if LDAP KDB interface should assume eDirectory.])
++elif test $with_dirsrv = yes; then
++  AC_MSG_NOTICE(enabling 389/Red Hat/Fedora/Netscape Directory Server database backend module support)
++  OPENLDAP_PLUGIN=yes
++  AC_DEFINE(HAVE_DIRSRV,1,[Define if LDAP KDB interface should assume RHDS/FDS/NDS.])
+ else
+   : # neither enabled
+ dnl  AC_MSG_NOTICE(disabling ldap backend module support)
+diff -up krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
+--- krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c	2009-02-18 13:14:48.000000000 -0500
++++ krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c	2009-06-04 14:38:07.000000000 -0400
+@@ -2157,6 +2157,22 @@ populate_krb5_db_entry (krb5_context con
+ 	}
+     }
+ #endif
++#ifdef HAVE_DIRSRV
++    {
++	krb5_timestamp              expiretime=0;
++	char                        *is_login_disabled=NULL;
++
++	/* LOGIN DISABLED */
++	if ((st=krb5_ldap_get_string(ld, ent, "nsaccountlock", &is_login_disabled,
++		    &attr_present)) != 0)
++	    goto cleanup;
++	if (attr_present == TRUE) {
++	    if (strcasecmp(is_login_disabled, "TRUE")== 0)
++		entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
++	    free (is_login_disabled);
++	}
++    }
++#endif
+ 
+     if ((st=krb5_read_tkt_policy (context, ldap_context, entry, tktpolname)) !=0)
+ 	goto cleanup;
+diff -up krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
+--- krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c	2009-04-14 17:07:34.000000000 -0400
++++ krb5-1.7/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c	2009-06-04 14:38:07.000000000 -0400
+@@ -58,6 +58,9 @@ char     *principal_attributes[] = { "kr
+ 				     "loginexpirationtime",
+ 				     "logindisabled",
+ #endif
++#ifdef HAVE_DIRSRV
++				     "nsaccountlock",
++#endif
+ 				     "krbLastPwdChange",
+ 				     "krbExtraData",
+ 				     "krbObjectReferences",