Re: [Freeipa-devel] global account lockout

2014-04-09 Thread Ludwig Krispenz
On 04/09/2014 12:31 AM, Simo Sorce wrote: On Tue, 2014-04-08 at 12:00 +0200, Ludwig Krispenz wrote: Replication storms. In my opinion the replication of a mod of one or two attribute in a entry will be faster than the bind itself. Think about the amplification effect in an environment with 20

Re: [Freeipa-devel] global account lockout

2014-04-09 Thread Petr Spacek
On 9.4.2014 15:50, Ludwig Krispenz wrote: On 04/09/2014 12:31 AM, Simo Sorce wrote: On Tue, 2014-04-08 at 12:00 +0200, Ludwig Krispenz wrote: Replication storms. In my opinion the replication of a mod of one or two attribute in a entry will be faster than the bind itself. Think about the

Re: [Freeipa-devel] global account lockout

2014-04-09 Thread Rich Megginson
On 04/09/2014 07:57 AM, Petr Spacek wrote: On 9.4.2014 15:50, Ludwig Krispenz wrote: On 04/09/2014 12:31 AM, Simo Sorce wrote: On Tue, 2014-04-08 at 12:00 +0200, Ludwig Krispenz wrote: Replication storms. In my opinion the replication of a mod of one or two attribute in a entry will be

Re: [Freeipa-devel] global account lockout

2014-04-09 Thread Simo Sorce
On Wed, 2014-04-09 at 15:50 +0200, Ludwig Krispenz wrote: Something like this is what we have experienced for real and cause us to actually disable replication of all the lockout related attributes in the past. But also here it can get complicated, we cannot really use failedlogincount

Re: [Freeipa-devel] global account lockout

2014-04-09 Thread Rich Megginson
On 04/09/2014 08:09 AM, Simo Sorce wrote: On Wed, 2014-04-09 at 15:50 +0200, Ludwig Krispenz wrote: Something like this is what we have experienced for real and cause us to actually disable replication of all the lockout related attributes in the past. But also here it can get complicated,

Re: [Freeipa-devel] global account lockout

2014-04-09 Thread Ludwig Krispenz
On 04/09/2014 04:17 PM, Rich Megginson wrote: On 04/09/2014 08:09 AM, Simo Sorce wrote: On Wed, 2014-04-09 at 15:50 +0200, Ludwig Krispenz wrote: Something like this is what we have experienced for real and cause us to actually disable replication of all the lockout related attributes in

Re: [Freeipa-devel] global account lockout

2014-04-09 Thread Gabe Alford
I came across these articles that may be of some use in this topic. I humbly admit that I am no expert on this topic, and these may not be of any use. Plus, I am not a fan of the product, but maybe it helps? http://technet.microsoft.com/en-us/library/cc772726%28v=ws.10%29.aspx

Re: [Freeipa-devel] global account lockout

2014-04-08 Thread Ludwig Krispenz
Looks like there was a great discussion while I was away :-) There seem to be great concerns (and mybe confusion) about replication update resoultions, conflicts and amount of meta data stored. I think it's not as bad as you may think. Large amounts of metadata can only accumulate for

Re: [Freeipa-devel] global account lockout

2014-04-08 Thread Simo Sorce
On Tue, 2014-04-08 at 12:00 +0200, Ludwig Krispenz wrote: Replication storms. In my opinion the replication of a mod of one or two attribute in a entry will be faster than the bind itself. Think about the amplification effect in an environment with 20 replicas. 1 login attempt - 20+ replication

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Rob Crittenden
Ludwig Krispenz wrote: Hi, please review the following feature design. It introduces a global account lockout, while trying to keep the replication traffic minimal. In my opinion for a real global account lockout the basic lockout attributes have to be replicated otherwise the benefit is

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Simo Sorce
On Mon, 2014-04-07 at 11:26 -0400, Rob Crittenden wrote: Ludwig Krispenz wrote: Hi, please review the following feature design. It introduces a global account lockout, while trying to keep the replication traffic minimal. In my opinion for a real global account lockout the basic lockout

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Simo Sorce
On Mon, 2014-04-07 at 12:01 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 11:26 -0400, Rob Crittenden wrote: Ludwig Krispenz wrote: Hi, please review the following feature design. It introduces a global account lockout, while trying to keep the replication traffic minimal. In my

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Simo Sorce
On Mon, 2014-04-07 at 12:10 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 12:01 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 11:26 -0400, Rob Crittenden wrote: Ludwig Krispenz wrote: Hi, please review the following feature design. It introduces a global account lockout,

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Rich Megginson
On 04/07/2014 10:13 AM, Simo Sorce wrote: On Mon, 2014-04-07 at 12:10 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 12:01 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 11:26 -0400, Rob Crittenden wrote: Ludwig Krispenz wrote: Hi, please review the following feature design. It introduces a

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Simo Sorce
On Mon, 2014-04-07 at 10:22 -0600, Rich Megginson wrote: On 04/07/2014 10:13 AM, Simo Sorce wrote: On Mon, 2014-04-07 at 12:10 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 12:01 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 11:26 -0400, Rob Crittenden wrote: Ludwig Krispenz wrote:

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Rich Megginson
On 04/07/2014 12:31 PM, Simo Sorce wrote: On Mon, 2014-04-07 at 10:22 -0600, Rich Megginson wrote: On 04/07/2014 10:13 AM, Simo Sorce wrote: On Mon, 2014-04-07 at 12:10 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 12:01 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 11:26 -0400, Rob

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Dmitri Pal
On 04/07/2014 02:31 PM, Simo Sorce wrote: On Mon, 2014-04-07 at 10:22 -0600, Rich Megginson wrote: On 04/07/2014 10:13 AM, Simo Sorce wrote: On Mon, 2014-04-07 at 12:10 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 12:01 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 11:26 -0400, Rob

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Simo Sorce
On Mon, 2014-04-07 at 14:47 -0400, Dmitri Pal wrote: On 04/07/2014 02:31 PM, Simo Sorce wrote: On Mon, 2014-04-07 at 10:22 -0600, Rich Megginson wrote: On 04/07/2014 10:13 AM, Simo Sorce wrote: On Mon, 2014-04-07 at 12:10 -0400, Simo Sorce wrote: On Mon, 2014-04-07 at 12:01 -0400, Simo

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Rich Megginson
On 04/07/2014 01:00 PM, Simo Sorce wrote: On Mon, 2014-04-07 at 14:47 -0400, Dmitri Pal wrote: On 04/07/2014 02:31 PM, Simo Sorce wrote: On Mon, 2014-04-07 at 10:22 -0600, Rich Megginson wrote: On 04/07/2014 10:13 AM, Simo Sorce wrote: On Mon, 2014-04-07 at 12:10 -0400, Simo Sorce wrote: On

Re: [Freeipa-devel] global account lockout

2014-04-07 Thread Rob Crittenden
Rich Megginson wrote: On 04/07/2014 01:00 PM, Simo Sorce wrote: On Mon, 2014-04-07 at 14:47 -0400, Dmitri Pal wrote: On 04/07/2014 02:31 PM, Simo Sorce wrote: On Mon, 2014-04-07 at 10:22 -0600, Rich Megginson wrote: On 04/07/2014 10:13 AM, Simo Sorce wrote: On Mon, 2014-04-07 at 12:10