Tivoli Directory Server requires that seconds be present in a

timestamp, even though RFC 4517 states that they are optional.

--HG--
branch : 1.7

diff --git a/ldap.c b/ldap.c
index d26e45812e6d28837c266d6652ccf9aeb8db4843..a1cf4a6c869e0ca96e44ae84905896de8a2fac3d 100644 (file)
--- a/ldap.c
+++ b/ldap.c
@@ -961,7 +961,7 @@ sudo_ldap_timefilter(buffer, buffersize)
     }
 
     /* Format the timestamp according to the RFC. */
-    if (strftime(timebuffer, sizeof(timebuffer), "%Y%m%d%H%MZ", tp) == 0) {
+    if (strftime(timebuffer, sizeof(timebuffer), "%Y%m%d%H%M%SZ", tp) == 0) {
        warning("unable to format timestamp");
        goto done;
     }

diff --git a/sudoers.ldap.pod b/sudoers.ldap.pod
index a9816546b348bdcb7e308d0cb4724cb4042ca08d..b12c6e6bb260c45aa7f12c9dcf0745be3da1cb01 100644 (file)
--- a/sudoers.ldap.pod
+++ b/sudoers.ldap.pod
@@ -147,11 +147,12 @@ The C<sudoRunAsGroup> attribute is only available in B<sudo> versions
 
 =item B<sudoNotBefore>
 
-A timestamp in the form C<yyyymmddHHMMZ> that can be used to provide
+A timestamp in the form C<yyyymmddHHMMSSZ> that can be used to provide
 a start date/time for when the C<sudoRole> will be valid.  If
 multiple C<sudoNotBefore> entries are present, the earliest is used.
 Note that timestamps must be in Coordinated Universal Time (UTC),
-not the local timezone.
+not the local timezone.  The minute and seconds portions are optional,
+but some LDAP servers require that they be present (contrary to the RFC).
 
 The C<sudoNotBefore> attribute is only available in B<sudo> versions
 1.7.5 and higher and must be explicitly enabled via the B<SUDOERS_TIMED>
@@ -159,11 +160,12 @@ option in F<@ldap_conf@>.
 
 =item B<sudoNotAfter>
 
-A timestamp in the form C<yyyymmddHHMMZ> that indicates an expiration
+A timestamp in the form C<yyyymmddHHMMSSZ> that indicates an expiration
 date/time, after which the C<sudoRole> will no longer be valid.  If
 multiple C<sudoNotBefore> entries are present, the last one is used.
 Note that timestamps must be in Coordinated Universal Time (UTC),
-not the local timezone.
+not the local timezone.  The minute and seconds portions are optional,
+but some LDAP servers require that they be present (contrary to the RFC).
 
 The C<sudoNotAfter> attribute is only available in B<sudo> versions
 1.7.5 and higher and must be explicitly enabled via the B<SUDOERS_TIMED>