RFC Feature Planning: User Groups

Scott Seago sseago at redhat.com
Thu Apr 12 01:24:40 UTC 2012


On 03/30/2012 09:50 AM, Scott Seago wrote:
> Rather than paste in the entire text, I'm just linking to the wiki 
> writeup. Please read the whole thing first and if you want to comment 
> on anything specific, quote it and comment on this thread.
>
>
> https://www.aeolusproject.org/redmine/projects/aeolus/wiki/Adding_User_Groups 
>
>
> Scott
>
Another couple rounds of revisions after discussion with Simo in #ipa. 
The doc is updated -- a brief summary of the changes follows inline here:

Essentially we're dropping the notion of keeping the LDAP group 
membership lists in sync with a cached copy in our database. Instead, 
we'll pull a list of a user's LDAP groups at login (along with 
membership in any local non-LDAP groups) and store these in a list of 
ActiveMembership objects, each of which will track (User, Group, 
Session). For each permission check we'll add the ActiveMembership 
association into the existing permission query joins to pull in 
permission grants to groups that the user belongs to.

See the  doc linked above for more details.

Scott



More information about the aeolus-devel mailing list