Radek Hladik wrote:
> I would like to ask one stupid question about account inactivation.
> When I use FDS console to deactivate user, it produces some "magic"
> with CoS to add operational attribute nsAccountLock to the specified
> user entry. Is there any reason why this is done so complicated?
It is done this way so that large numbers of accounts can be activated
or deactivated with one single modification.
> Why the nsAccountLock attribute can not be specified as optional
> attribute in for example posixAccount class? And is this approach
> possible in case I need only user account inactivation (I mean no
> groups or roles)?
You should not do that because it modifies standard schema, and no good
will come of that.
> I need to provide our account administrators with some easy
> possibility to inactivate account via phpldapadmin and I would like to
> do it in as standard way as possible. Of course we could change the
> password hash specifier i.e. from {SSHA} to {SSHA-disabled} but I
> consider this as last resort option.
You can do that right now. Add nsAccountLock: true to an entry it will
be locked. Operational attributes don't require that the entry have a
particular objectclass to pass schema check.
--
Pete
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20061108/c5137f07/attachment.bin
