Pavel Zůna wrote:
Rob Crittenden wrote:Not necessarily. It's just a matter of tweaking the search filter. We can search only for CoS entries, that have the krbContainer object class and their krbPwdReference attribute contains a group DN.Pavel Zuna wrote:Jason Gerard DeRose wrote:The patch works, but I find the way it checks for priority uniqueness highly ineffective. It pulls out all policies and then retrieves their CoS entries one by one to do the checking. Instead it should just make a search for a CoS entry with the given priority.On Fri, 2010-03-12 at 18:01 -0500, Rob Crittenden wrote:Ensure that the group policy priority is unique.We use CoS to determine the order in which group policy is applied. The behavior in CoS is undefined for multiple entries with the samecospriority. This likely relies on some other outstanding pwpolicy patches. roback. pushed to master.PavelWell, we may need to store the group policy entries in a subtree then. All CoS policies are currently dumped into the same place making this impossible.
Oh right, duh. Yeah, it is even simpler than that as we don't need to look at group dns because only group policy is stored this way.
New patch attached. rob
freeipa-404-2-pwpolicy.patch
Description: application/mbox
_______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
