|
 |
8e1ca3 |
From 1aa39529cda4ab9620539dbad705cedd23c21b42 Mon Sep 17 00:00:00 2001
|
|
|
8e1ca3 |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
8e1ca3 |
Date: Thu, 18 Aug 2022 08:21:58 -0400
|
|
|
8e1ca3 |
Subject: [PATCH] doc: Update LDAP grace period design with default values
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
New group password policies will get -1 (unlimited) on creation
|
|
|
8e1ca3 |
by default.
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
Existing group password policies will remain untouched and
|
|
|
8e1ca3 |
those created prior will be treated as no BIND allowed.
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
Fixes: https://pagure.io/freeipa/issue/9212
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
|
|
|
8e1ca3 |
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
|
|
|
8e1ca3 |
---
|
|
|
8e1ca3 |
doc/designs/ldap_grace_period.md | 17 ++++++++++++++++-
|
|
|
8e1ca3 |
1 file changed, 16 insertions(+), 1 deletion(-)
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
diff --git a/doc/designs/ldap_grace_period.md b/doc/designs/ldap_grace_period.md
|
|
|
8e1ca3 |
index 4b9db34247c1446aec3f5bcce7dfa1bd8a2bd359..e26aedda976b19f3ba26593ba3b3c06c30506a21 100644
|
|
|
8e1ca3 |
--- a/doc/designs/ldap_grace_period.md
|
|
|
8e1ca3 |
+++ b/doc/designs/ldap_grace_period.md
|
|
|
8e1ca3 |
@@ -51,7 +51,22 @@ The basic flow is:
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
On successful password reset (by anyone) reset the user's passwordGraceUserTime to 0.
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
-The default value on install/upgrade will be -1 to retail existing behavior.
|
|
|
8e1ca3 |
+Range values for passwordgracelimit are:
|
|
|
8e1ca3 |
+
|
|
|
8e1ca3 |
+-1 : password grace checking is disabled
|
|
|
8e1ca3 |
+ 0 : no grace BIND are allowed at all post-expiration
|
|
|
8e1ca3 |
+ 1..MAXINT: the number of BIND allowed post-expiration
|
|
|
8e1ca3 |
+
|
|
|
8e1ca3 |
+The default value for the global policy on install/upgrade will be -1 to
|
|
|
8e1ca3 |
+retain existing behavior.
|
|
|
8e1ca3 |
+
|
|
|
8e1ca3 |
+New group password policies will default to -1 to retain previous
|
|
|
8e1ca3 |
+behavior.
|
|
|
8e1ca3 |
+
|
|
|
8e1ca3 |
+Existing group policies with no grace limit set are updated to use
|
|
|
8e1ca3 |
+the default unlimited value, -1. This is done because lack of value in
|
|
|
8e1ca3 |
+LDAP is treated as 0 so any existing group policies would not allow
|
|
|
8e1ca3 |
+post-expiration BIND so this will avoid confusion.
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
The per-user attempts will not be replicated.
|
|
|
8e1ca3 |
|
|
|
8e1ca3 |
--
|
|
|
8e1ca3 |
2.37.2
|
|
|
8e1ca3 |
|