8e9e1c07b0
- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
the DISALLOW_ALL_TIX flag is set on an entry, for better interop with
Fedora, Netscape, Red Hat Directory Server (Simo Sorce)
67 lines
2.7 KiB
Diff
67 lines
2.7 KiB
Diff
diff -ur krb5-1.6.2.orig/src/aclocal.m4 krb5-1.6.2/src/aclocal.m4
|
|
--- krb5-1.6.2.orig/src/aclocal.m4 2007-11-20 11:39:51.000000000 -0500
|
|
+++ krb5-1.6.2/src/aclocal.m4 2007-11-20 12:09:56.000000000 -0500
|
|
@@ -1798,6 +1798,12 @@
|
|
yes | no) ;;
|
|
*) AC_MSG_ERROR(Invalid option value --with-edirectory="$withval") ;;
|
|
esac], with_edirectory=no)dnl
|
|
+AC_ARG_WITH([dirsrv],
|
|
+[ --with-dirsrv compile Red Hat/Fedora/Netscape Directory Server database backend module],
|
|
+[case "$withval" in
|
|
+ yes | no) ;;
|
|
+ *) AC_MSG_ERROR(Invalid option value --with-dirsrv="$withval") ;;
|
|
+esac], with_dirsrv=no)dnl
|
|
|
|
if test $with_ldap = yes; then
|
|
if test $with_edirectory = yes; then
|
|
@@ -1809,6 +1815,10 @@
|
|
AC_MSG_NOTICE(enabling eDirectory database backend module support)
|
|
OPENLDAP_PLUGIN=yes
|
|
AC_DEFINE(HAVE_EDIRECTORY,1,[Define if LDAP KDB interface should assume eDirectory.])
|
|
+elif test $with_dirsrv = yes; then
|
|
+ AC_MSG_NOTICE(enabling Red Hat/Fedora/Netscape Directory Server database backend module support)
|
|
+ OPENLDAP_PLUGIN=yes
|
|
+ AC_DEFINE(HAVE_DIRSRV,1,[Define if LDAP KDB interface should assume RHDS/FDS/NDS.])
|
|
else
|
|
: # neither enabled
|
|
dnl AC_MSG_NOTICE(disabling ldap backend module support)
|
|
diff -ur krb5-1.6.2.orig/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c krb5-1.6.2/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
|
|
--- krb5-1.6.2.orig/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c 2006-12-21 23:28:09.000000000 -0500
|
|
+++ krb5-1.6.2/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c 2007-11-20 12:04:10.000000000 -0500
|
|
@@ -2141,6 +2141,22 @@
|
|
}
|
|
}
|
|
#endif
|
|
+#ifdef HAVE_DIRSRV
|
|
+ {
|
|
+ krb5_timestamp expiretime=0;
|
|
+ char *is_login_disabled=NULL;
|
|
+
|
|
+ /* LOGIN DISABLED */
|
|
+ if ((st=krb5_ldap_get_string(ld, ent, "nsaccountlock", &is_login_disabled,
|
|
+ &attr_present)) != 0)
|
|
+ goto cleanup;
|
|
+ if (attr_present == TRUE) {
|
|
+ if (strcasecmp(is_login_disabled, "TRUE")== 0)
|
|
+ entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
|
|
+ free (is_login_disabled);
|
|
+ }
|
|
+ }
|
|
+#endif
|
|
|
|
if ((st=krb5_read_tkt_policy (context, ldap_context, entry, tktpolname)) !=0)
|
|
goto cleanup;
|
|
diff -ur krb5-1.6.2.orig/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c krb5-1.6.2/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
|
|
--- krb5-1.6.2.orig/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c 2007-01-03 19:27:26.000000000 -0500
|
|
+++ krb5-1.6.2/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c 2007-11-20 12:00:27.000000000 -0500
|
|
@@ -57,6 +57,9 @@
|
|
"loginexpirationtime",
|
|
"logindisabled",
|
|
#endif
|
|
+#ifdef HAVE_DIRSRV
|
|
+ "nsaccountlock",
|
|
+#endif
|
|
"loginexpirationtime",
|
|
"logindisabled",
|
|
"modifytimestamp",
|