<def-group oval_version="5.11">
  <definition class="compliance" id="sssd_offline_cred_expiration" version="1">
    {{{ oval_metadata("SSSD should be configured to expire offline credentials after 1 day.") }}}
    <criteria operator="OR">
      <criterion comment="Check offline_credentials_expiration in /etc/sssd/sssd.conf"
      test_ref="test_sssd_offline_cred_expiration" />
      {{% if product in ["ol8", "ol9"] or 'rhel' in product %}}
      <criterion comment="Check cache_credentials in /etc/sssd/sssd.conf"
      test_ref="test_sssd_cache_credentials" />
      {{% endif %}}
    </criteria>
  </definition>
  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="tests the value of offline_credentials_expiration setting in the /etc/sssd/sssd.conf file"
  id="test_sssd_offline_cred_expiration" version="1">
    <ind:object object_ref="obj_sssd_offline_cred_expiration" />
    <ind:state state_ref="state_sssd_offline_cred_expiration" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_sssd_offline_cred_expiration" version="1">
    {{% if product == 'rhel8' %}}
    <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
    {{% else %}}
    <ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
    {{% endif %}}    <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*(\d+)\s*(?:#.*)?$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_sssd_offline_cred_expiration" version="1">
    <ind:subexpression>1</ind:subexpression>
  </ind:textfilecontent54_state>
  {{% if product in ["ol8", "ol9"] or 'rhel' in product %}}
  <ind:textfilecontent54_test check="all" check_existence="any_exist"
  comment="tests the value of cache_credentials setting in the /etc/sssd/sssd.conf file"
  id="test_sssd_cache_credentials" version="1">
    <ind:object object_ref="obj_sssd_cache_credentials" />
    <ind:state state_ref="state_sssd_cache_credentials" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_sssd_cache_credentials" version="1">
    {{% if product == 'rhel8' %}}
    <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
    {{% else %}}
    <ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
    {{% endif %}}
    <ind:pattern operation="pattern match">^[\s]*cache_credentials\s*=\s*(\w+)\s*(?:#.*)?$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_state id="state_sssd_cache_credentials" version="1">
    <ind:subexpression operation="case insensitive equals">false</ind:subexpression>
  </ind:textfilecontent54_state>
  {{% endif %}}
</def-group>
