On 03/30/2012 09:50 AM, Scott Seago wrote:
Rather than paste in the entire text, I'm just linking to the
writeup. Please read the whole thing first and if you want to comment
on anything specific, quote it and comment on this thread.
Another couple rounds of revisions after discussion with Simo in #ipa.
The doc is updated -- a brief summary of the changes follows inline here:
Essentially we're dropping the notion of keeping the LDAP group
membership lists in sync with a cached copy in our database. Instead,
we'll pull a list of a user's LDAP groups at login (along with
membership in any local non-LDAP groups) and store these in a list of
ActiveMembership objects, each of which will track (User, Group,
Session). For each permission check we'll add the ActiveMembership
association into the existing permission query joins to pull in
permission grants to groups that the user belongs to.
See the doc linked above for more details.