On 04/01/2015 07:09 AM, Prashant Bapat wrote:
> Hi ,
> Is there a way of making the nsAccountLock attribute (User enable/disable)
> to be anonymously readable ?
> I'm trying to implement a SSH key lookup sshd authorized key command
> script. Based on this attribute the user will be allowed to login. I need
> this to be anonymously readable.
> Tried setting the permissions but it does not work.
Permissions should just work. You can either switch "System: Read User
Addressbook Attributes" permission for anonymous user, with knowing all
consequences it brings to your system, all create a new read permission just
for this attribute.
BTW, note that this attribute is operational and has to be searched out
explicitly in the ldapsearch, e.g.:
# ldapsearch -Y GSSAPI -h `hostname` -b "uid=fbar,cn=users,cn=accounts,dc=f21"
SASL/GSSAPI authentication started
SASL username: admin@F21
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
# base <uid=fbar,cn=users,cn=accounts,dc=f21> with scope subtree
# filter: (objectclass=*)
# requesting: nsaccountlock
# fbar, users, accounts, f21
# search result
result: 0 Success
# numResponses: 2
# numEntries: 1
Final note, new users do not have this attribute until the first time they are
Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project