This module provides a mechanism to handle shibboleth-expired users. The module is compatible with the overquota-handling mechanism provided by the same package. It replaces the ok_policy_enforce.py script and provides a way to migrate from the existing state.
The policy of this module defines the following types of shibboleth states:
You can specify after how many days without a shibboleth login the shibboleth account is considered expired, and define how many days after expiration the states SHIBBOLETH_NOTICE and SHIBBOLETH_SUSPEND can apply. Settings reside at 20-okeanos-policy.conf, for example the following settings:
specify that a shibboleth account expires 60 days without login, and after that, the user will be notified in zero, five, and eight days, and finally will be suspended in 15 days.
A shibboleth-expired user is “suspended” by means of:
No actual resource (e.g. VM) is directly affected; however, due to project membership suspension, the user becomes overquota and their resources will be reclaimed by the dedicated overquota script.
If a user logs in again using shibboleth, they can be recovered. The mechanism keeps track which projects/memberships had been suspended due to shibboleth expiration in order to unsuspend them.
Management command shibboleth-enforce applies the policy. When run without arguments, it first looks for users that have logged in using shibboleth and need to be recovered. It then looks for users that are expired in order to apply the policy.
The command is meant to run daily with:
snf-manage shibboleth-enforce --run
In order to migrate from the old script ok_policy_enforce.py, run:
snf-manage shibboleth-enforce --migrate-ok-policy-enforce
This will first detect users that must be recovered and then migrate shibboleth states as explained below:
Use –run` to actually do the migrations.