Blame SOURCES/krb5-1.13-dirsrv-accountlock.patch

5af5b2
Treat 'nsAccountLock: true' the same as 'loginDisabled: true'.  Updated from
5af5b2
original version filed as RT#5891.
5af5b2
5af5b2
diff -up krb5-1.8/src/aclocal.m4.dirsrv-accountlock krb5-1.8/src/aclocal.m4
5af5b2
--- krb5-1.8/src/aclocal.m4.dirsrv-accountlock	2010-03-05 11:03:09.000000000 -0500
5af5b2
+++ krb5-1.8/src/aclocal.m4	2010-03-05 11:03:10.000000000 -0500
5af5b2
@@ -1656,6 +1656,15 @@ if test $with_ldap = yes; then
5af5b2
   AC_MSG_NOTICE(enabling OpenLDAP database backend module support)
5af5b2
   OPENLDAP_PLUGIN=yes
5af5b2
 fi
5af5b2
+AC_ARG_WITH([dirsrv-account-locking],
5af5b2
+[  --with-dirsrv-account-locking       compile 389/Red Hat/Fedora/Netscape Directory Server database backend module],
5af5b2
+[case "$withval" in
5af5b2
+    yes | no) ;;
5af5b2
+    *)  AC_MSG_ERROR(Invalid option value --with-dirsrv-account-locking="$withval") ;;
5af5b2
+esac], with_dirsrv_account_locking=no)
5af5b2
+if test $with_dirsrv_account_locking = yes; then
5af5b2
+    AC_DEFINE(HAVE_DIRSRV_ACCOUNT_LOCKING,1,[Define if LDAP KDB interface should heed 389 DS's nsAccountLock attribute.])
5af5b2
+fi
5af5b2
 ])dnl
5af5b2
 dnl
5af5b2
 dnl If libkeyutils exists (on Linux) include it and use keyring ccache
5af5b2
diff -up krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c.dirsrv-accountlock krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
5af5b2
--- krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c.dirsrv-accountlock	2009-11-24 18:52:25.000000000 -0500
5af5b2
+++ krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c	2010-03-05 11:03:10.000000000 -0500
01ee0a
@@ -1546,6 +1546,23 @@ populate_krb5_db_entry(krb5_context cont
01ee0a
     ret = krb5_dbe_update_tl_data(context, entry, &userinfo_tl_data);
01ee0a
     if (ret)
5af5b2
         goto cleanup;
5af5b2
+#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING
5af5b2
+    {
5af5b2
+        krb5_timestamp              expiretime=0;
5af5b2
+        char                        *is_login_disabled=NULL;
5af5b2
+
5af5b2
+        /* LOGIN DISABLED */
01ee0a
+        ret = krb5_ldap_get_string(ld, ent, "nsAccountLock", &is_login_disabled,
01ee0a
+                                   &attr_present);
01ee0a
+        if (ret)
5af5b2
+            goto cleanup;
5af5b2
+        if (attr_present == TRUE) {
5af5b2
+            if (strcasecmp(is_login_disabled, "TRUE")== 0)
5af5b2
+                entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
5af5b2
+            free (is_login_disabled);
5af5b2
+        }
5af5b2
+    }
5af5b2
+#endif
5af5b2
 
01ee0a
     ret = krb5_read_tkt_policy(context, ldap_context, entry, tktpolname);
01ee0a
     if (ret)
5af5b2
         goto cleanup;
5af5b2
diff -up krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c.dirsrv-accountlock krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
5af5b2
--- krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c.dirsrv-accountlock	2009-11-24 18:52:25.000000000 -0500
5af5b2
+++ krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c	2010-03-05 11:03:10.000000000 -0500
5af5b2
@@ -59,6 +59,9 @@ char     *principal_attributes[] = { "kr
5af5b2
                                      "krbLastFailedAuth",
5af5b2
                                      "krbLoginFailedCount",
5af5b2
                                      "krbLastSuccessfulAuth",
5af5b2
+#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING
5af5b2
+                                     "nsAccountLock",
5af5b2
+#endif
5af5b2
                                      "krbLastPwdChange",
5af5b2
                                      "krbLastAdminUnlock",
5af5b2
                                      "krbExtraData",