RFC Feature Planning: User Groups
Scott Seago
sseago at redhat.com
Thu Apr 12 01:24:40 UTC 2012
On 03/30/2012 09:50 AM, Scott Seago wrote:
> Rather than paste in the entire text, I'm just linking to the wiki
> writeup. Please read the whole thing first and if you want to comment
> on anything specific, quote it and comment on this thread.
>
>
> https://www.aeolusproject.org/redmine/projects/aeolus/wiki/Adding_User_Groups
>
>
> Scott
>
Another couple rounds of revisions after discussion with Simo in #ipa.
The doc is updated -- a brief summary of the changes follows inline here:
Essentially we're dropping the notion of keeping the LDAP group
membership lists in sync with a cached copy in our database. Instead,
we'll pull a list of a user's LDAP groups at login (along with
membership in any local non-LDAP groups) and store these in a list of
ActiveMembership objects, each of which will track (User, Group,
Session). For each permission check we'll add the ActiveMembership
association into the existing permission query joins to pull in
permission grants to groups that the user belongs to.
See the doc linked above for more details.
Scott
More information about the aeolus-devel
mailing list