[SSSD] Re: [PATCH] PAM: Notify user of denial due to AD account lockout

[Lukas Slebodnik]

On (17/02/16 13:54), Jakub Hrozek wrote:
> On Fri, Feb 12, 2016 at 02:37:05PM +0100, Pavel Reichl wrote:
> > 
> > 
> > On 02/12/2016 02:19 PM, Pavel Reichl wrote:
> > >
> > >
> > >On 02/09/2016 04:25 PM, Pavel Reichl wrote:
> > >>
> > >>
> > >>On 02/09/2016 08:09 AM, Jakub Hrozek wrote:
> > >>>On Mon, Feb 08, 2016 at 01:56:07PM +0100, Pavel Reichl wrote:
> > >>
> > >>>>diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
> > >>>>index
> 73a21bfa0049bc4d3cfacb49201707868c87e533..2dbc58a451686beda0faa9e9366bbc3b3b4c253e 100644
> > >>>>--- a/src/man/sssd.conf.5.xml
> > >>>>+++ b/src/man/sssd.conf.5.xml
> > >>>>@@ -1040,6 +1040,27 @@ pam_account_expired_message = Account expired,
> please call help desk.
> > >>>>                      </listitem>
> > >>>>                  </varlistentry>
> > >>>>                  <varlistentry>
> > >>>>+                    <term>pam_account_locked_message
> (string)</term>
> > >>>>+                    <listitem>
> > >>>>+                        <para>
> > >>>>+                           If user is authenticating and
> > >>>
> > >>>Please ask someone for an English review (I know Dan started, but I
> > >>>didn't see a fixed version yet). At the very least, this should read
> "a
> > >>>user".
> > >>
> > >>I attached Dan's patch. I took the liberty of adding note regarding pam
> verbosity. Hope it's fine by Dan.
> > >>
> > >>>
> > >>>>+                           account is locked then by default
> > >>>>+                           'Permission denied' is output.
> This output will
> > >>>>+                           be changed to content of this variable if
> it is
> > >>>>+                           set.
> > >>>>+                        </para>
> > >>>>+                        <para>
> > >>>>+                            example:
> > >>>>+                            <programlisting>
> > >>>>+pam_account_locked_message = Account locked, please call help desk.
> > >>>>+                            </programlisting>
> > >>>>+                        </para>
> > >>>>+                        <para>
> > >>>>+                            Default: none
> > >>>>+                        </para>
> > >>>>+                    </listitem>
> > >>>>+                </varlistentry>
> > >>>>+                <varlistentry>
> > >>>>                      <term>p11_child_timeout
> (integer)</term>
> > >>>>                      <listitem>
> > >>>>                          <para>
> > >>>
> > >>>The rest of the patch looks good to me and seems to work as advertized.
> > >>
> > >>Thanks.
> > >>
> > >
> > >Patch set with amended commit message. Commit message was acked by AB.
> > >
> > Lukas asked me for adding comment regarding documenting '775' string to the
> code. Please see updated patch set. Thanks.
>
> I think we've reviewed these patches enough :)
>
> ACK
>
> CI link: http://sssd-ci.duckdns.org/logs/job/37/40/summary.html 
master:
* 09092b6535b711b9b734ed0c047c671de9e6cafd
* 4180d485829969d4626cc7d49d2b5f7146512f21
* ff275f4c0b8cc1a098dbd0c5f6d52d6a93cda597

sssd-1-13:
* ffe3df61d85c2890a31d627c5e6fe8890f1e26d8
* 1b9f294dab02e6bcd4ce54e3447648d3d664ceaa
* 81cb4057920c6296b7f7e6b7c651fdb601ff0338

LS