Pull Novell's eDir patches from the HEAD

diff --git a/INSTALL b/INSTALL
index 647c57e..8c59af0 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -47,6 +47,8 @@ following list is a selection from the available flags:
   --with-experimental-modules      Use experimental and unstable modules. (default=no) 
   --enable-developer      Turns on super-duper-extra-compile-warnings
                               when using gcc.
+  --with-edir             Compile with support for Novell eDirectory
+                              integration.
 
   To get the defaults that Cistron Radius used up to 1.5.4.3-beta18, use:
 

diff --git a/doc/ldap_howto.txt b/doc/ldap_howto.txt
index 9ea421f..f53804c 100644 (file)
--- a/doc/ldap_howto.txt
+++ b/doc/ldap_howto.txt
@@ -985,7 +985,15 @@ ldap {
   ldap_cache_size = 0
   ldap_connections_number = 10
   #password_header = {clear}
+#While integrating FreeRADIUS with Novell eDirectory, set
+#'password_attribute = nspmpassword' in order to use the universal password
+#of the eDirectory users for RADIUS authentication. This will work only if
+#FreeRADIUS is configured to build with --with-edir option.
   password_attribute = userPassword
+#Comment out the following to disable the eDirectory account policy check and
+#intruder detection. This will work only if FreeRADIUS is configured to build
+#with --with-edir option.
+#edir_account_policy_check=no
   groupname_attribute = radiusGroupName
   groupmembership_filter = (&(uid=%{Stripped-User-Name:-%{User-Name}})
   (objectclass=radiusprofile))

diff --git a/doc/rlm_ldap b/doc/rlm_ldap
index 79c9d0a..5c870a3 100644 (file)
--- a/doc/rlm_ldap
+++ b/doc/rlm_ldap
@@ -178,11 +178,24 @@ the rlm_ldap module:
 
 #      password_attribute: Define the attribute which contains the user
 #      password.
+#      While integrating FreeRADIUS with Novell eDirectory, set
+#      'password_attribute = nspmpassword' in order to use the universal
+#      password of the eDirectory users for RADIUS authentication. This will
+#      work only if FreeRADIUS is configured to build with --with-edir option.
 #
 #      default: NULL - don't add password
 #
 #      password_attribute = "userPassword"
 
+#      edir_account_policy_check: Specifies if the module has to enforce
+#      Novell eDirectory account policy check and intruder detection for
+#      RADIUS users.  This will work only if FreeRADIUS is configured to build
+#      with --with-edir option.
+#
+#      default: yes - eDirectory account policy check enabled
+#
+#      edir_account_policy_check = no
+
 #      groupname_attribute: The attribute containing group name in the LDAP
 #      server. It is used to search group by name.
 #

diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
index 881955b..377514c 100644 (file)
--- a/raddb/radiusd.conf.in
+++ b/raddb/radiusd.conf.in
@@ -770,6 +770,13 @@ $INCLUDE ${confdir}/eap.conf
                #  This goes for NT-Passwords stored in SQL, too.
                #
                # password_attribute = userPassword
+               #
+               # Un-comment the following to disable Novell eDirectory account
+               # policy check and intruder detection. This will work *only if*
+               # FreeRADIUS is configured to build with --with-edir option.
+               #
+               # edir_account_policy_check=no
+               #
                # groupname_attribute = cn
                # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
                # groupmembership_attribute = radiusGroupName
@@ -1819,8 +1826,17 @@ post-auth {
 #      sql
 
        #
-       #  Access-Reject packets are sent through the REJECT sub-section
-       #  of the post-auth section.
+       #  Un-comment the following if you have set
+       #  'edir_account_policy_check = yes' in the ldap module sub-section of
+       #  the 'modules' section.
+       #
+#      ldap
+       #
+       #  Access-Reject packets are sent through the REJECT sub-section of the
+       #  post-auth section.
+       #  Uncomment the following and set the module name to the ldap instance
+       #  name if you have set 'edir_account_policy_check = yes' in the ldap
+       #  module sub-section of the 'modules' section.
        #
 #      Post-Auth-Type REJECT {
 #              insert-module-name-here