Antw: Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs

["Ulrich Windl" <Ulrich.Windl@rz.uni-regensburg.de>]

>>> Quanah Gibson-Mount <quanah@symas.com> schrieb am 03.01.2017 um 00:11 in
Nachricht <F365AC223D2A1E22A5345243@[192.168.1.30]>:
> --On Monday, January 02, 2017 2:40 PM +0100 Matthieu Cerda 
> <matthieu.cerda@nbs-system.com> wrote:
> 
>> Thank you very much Quanah !
>>
>> Do you think adding a note about mandatory rootdn setting in
>> slapo-ppolicy manpage would be a worthy contribution ? (I'll gladly
>> submit a patch)
> 
> Hi Matthieu,
> 
> It's already currently noted in the 3rd paragraph of the man page:
> 
>        Note that some of the policies do not take effect when the operation 
> is
>        performed with the rootdn identity; all the operations, when 
> performed
>        with  any  other identity, may be subjected to constraints, like 
> access
>        control.
> 
> 
> Note the bit about "all the operations, ..."
> 
> If you think of a way to reword it that you feel is a better explanation, 
> that could certainly be considered. :)

I think a notice who is the modifier on ppolicy changes would be woth it; specifically if it's related to RootDN ;-)
I think I had already asked earlier about some notice on ACLs that ppolicy may or may not need to work.

Regards,
Ulrich

> 
> Regards,
> Quanah
> 
> --
> 
> Quanah Gibson-Mount
> Product Architect
> Symas Corporation
> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
> <http://www.symas.com>