From jhrozek at redhat.com Thu Aug 20 12:56:33 2015 Content-Type: multipart/mixed; boundary="===============0890920182042667340==" MIME-Version: 1.0 From: Jakub Hrozek To: sssd-devel at lists.fedorahosted.org Subject: Re: [SSSD] [sssd][pathces] MAN: nested group membership Date: Mon, 02 Jun 2014 15:13:32 +0200 Message-ID: <20140602131332.GF25291@hendrix.brq.redhat.com> In-Reply-To: 538C6C76.8080006@redhat.com --===============0890920182042667340== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Mon, Jun 02, 2014 at 08:22:14AM -0400, Stephen Gallagher wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > = > On 06/01/2014 04:09 PM, Jakub Hrozek wrote: > > On Fri, May 30, 2014 at 06:04:01PM +0200, Pavel Reichl wrote: > >> OK, please see updated patch. PR > > = > > Thank you, from content point of view, this looks correct to me. > > = > > Can you please ping some native English speaker before I push the = > > patch? There are two parts below that I'm not sure about, but as I > > said, it's not about content, just ironing out the language. > > = > > [snip] > > = > >> @@ -1776,7 +1776,14 @@ users being denied access. Use > >> access_provider =3D permit to change this default behavior. Please > >> note that this filter is applied on - > >> the LDAP user entry only. + the LDAP > >> user entry only and thus filtering based + > >> on nested groups may not work (e.g. memberOf + > >> attribute on AD entries points only on direct > = > "points only *to* direct parents" > = > >> + parents). If nested group based > >> filtering is + desired please see > > = > = > "If filtering based on nested groups is required, please see" > = > = > > Maybe required instead of desired? > > = > >> + + > >> sssd-simple5 > >> > >> = > + . > >> Example: diff --git a/src/man/sssd-simple.5.xml > >> b/src/man/sssd-simple.5.xml index > >> 8f94990da9d94dca2f6b5730aaab6b4468fed487..5a0af337e3a45175aaa7a1a36fae= 5c1da2ead0c4 > >> 100644 --- a/src/man/sssd-simple.5.xml +++ > >> b/src/man/sssd-simple.5.xml @@ -144,6 +144,18 @@ = > >> > >> = > >> + + NOTES + > >> + The complete group memberships are resolved > >> before the access check, > > = > > I'm not sure if "group memberships are" should read "group > > membership is", iow if it's better to use singular or plural > > here.. > > = > = > "The complete group membership hierarchy is resolved before the access > check, thus even nested groups..." > = > = > >> + so even nested groups can be included in the access > >> lists. Please be + aware of ldap_group_nesting_level > = > = > "Please be aware that the 'ldap_group_nesting_level' option may impact > the results and should be set to a sufficient value." Thanks for the review! Pavel is not around today, so I took the liberty of updating the patch with your suggestions so we can move forward. --===============0890920182042667340== Content-Type: text/plain MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-MAN-hint-nested-groups-by-simple-access-provider.patch" PkZyb20gZWYyMjE4YTdiOGM1YmU4MjU1NTViNzZlYjI3Yjg3ZWM2YzdiMGY0NCBNb24gU2VwIDE3 IDAwOjAwOjAwIDIwMDEKRnJvbTogUGF2ZWwgUmVpY2hsIDxwcmVpY2hsQHJlZGhhdC5jb20+CkRh dGU6IFRodSwgMTAgQXByIDIwMTQgMTY6MjU6NDUgKzAxMDAKU3ViamVjdDogW1BBVENIXSBNQU46 IGhpbnQgbmVzdGVkIGdyb3VwcyBieSBzaW1wbGUgYWNjZXNzIHByb3ZpZGVyCgpzc3NkLWxkYXAg aGludHMgdG8gdXNlIHRoZSBzaW1wbGUgYWNjZXNzIHByb3ZpZGVyIGlmIGEgbmVzdGVkIGdyb3Vw IG1lbWJlcnNoaXAKaXMgbmVlZGVkLiBBZGQgZXhwbGljaXQgbm90aWNlIGluIHNzc2Qtc2ltcGxl IGFib3V0IHN1cHBvcnQgb2YgbmVzdGVkIGdyb3VwCm1lbWJlcnNoaXAuCgpSZXNvbHZlczoKaHR0 cHM6Ly9mZWRvcmFob3N0ZWQub3JnL3Nzc2QvdGlja2V0LzIzMDgKLS0tCiBzcmMvbWFuL3Nzc2Qt bGRhcC41LnhtbCAgIHwgIDkgKysrKysrKystCiBzcmMvbWFuL3Nzc2Qtc2ltcGxlLjUueG1sIHwg MTQgKysrKysrKysrKysrKysKIDIgZmlsZXMgY2hhbmdlZCwgMjIgaW5zZXJ0aW9ucygrKSwgMSBk ZWxldGlvbigtKQoKZGlmZiAtLWdpdCBhL3NyYy9tYW4vc3NzZC1sZGFwLjUueG1sIGIvc3JjL21h bi9zc3NkLWxkYXAuNS54bWwKaW5kZXggNjQyNmZlNGZjYTVkYzliYjliYzg0ZmNiZjYzMzQwNDE0 NDA1MmQwMS4uOTNhN2UzNjJhOTliMDk5NGE3Zjk2NGY5MjhhMzk0YzY1ODhhMzk3ZiAxMDA2NDQK LS0tIGEvc3JjL21hbi9zc3NkLWxkYXAuNS54bWwKKysrIGIvc3JjL21hbi9zc3NkLWxkYXAuNS54 bWwKQEAgLTE4MjQsNyArMTgyNCwxNCBAQAogICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVz ZXJzIGJlaW5nIGRlbmllZCBhY2Nlc3MuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVXNl IGFjY2Vzc19wcm92aWRlciA9IHBlcm1pdCB0byBjaGFuZ2UgdGhpcyBkZWZhdWx0CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgYmVoYXZpb3IuIFBsZWFzZSBub3RlIHRoYXQgdGhpcyBmaWx0 ZXIgaXMgYXBwbGllZCBvbgotICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBMREFQIHVz ZXIgZW50cnkgb25seS4KKyAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgTERBUCB1c2Vy IGVudHJ5IG9ubHkgYW5kIHRodXMgZmlsdGVyaW5nIGJhc2VkCisgICAgICAgICAgICAgICAgICAg ICAgICAgICAgb24gbmVzdGVkIGdyb3VwcyBtYXkgbm90IHdvcmsgKGUuZy4gbWVtYmVyT2YKKyAg ICAgICAgICAgICAgICAgICAgICAgICAgICBhdHRyaWJ1dGUgb24gQUQgZW50cmllcyBwb2ludHMg b25seSB0byBkaXJlY3QKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICBwYXJlbnRzKS4gSWYg ZmlsdGVyaW5nIGJhc2VkIG9uIG5lc3RlZCBncm91cHMKKyAgICAgICAgICAgICAgICAgICAgICAg ICAgICBpcyByZXF1aXJlZCwgcGxlYXNlIHNlZQorICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxjaXRlcmVmZW50cnk+CisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8cmVmZW50cnl0 aXRsZT5zc3NkLXNpbXBsZTwvcmVmZW50cnl0aXRsZT48bWFudm9sbnVtPjU8L21hbnZvbG51bT4K KyAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2NpdGVyZWZlbnRyeT4uCiAgICAgICAgICAg ICAgICAgICAgICAgICA8L3BhcmE+CiAgICAgICAgICAgICAgICAgICAgICAgICA8cGFyYT4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBFeGFtcGxlOgpkaWZmIC0tZ2l0IGEvc3JjL21hbi9z c3NkLXNpbXBsZS41LnhtbCBiL3NyYy9tYW4vc3NzZC1zaW1wbGUuNS54bWwKaW5kZXggOGY5NDk5 MGRhOWQ5NGRjYTJmNmI1NzMwYWFhYjZiNDQ2OGZlZDQ4Ny4uMGQ2NzdiZDI5MzkyNWQ5ZWVkMGVh MTY1NDhmYWQzY2FmM2JiM2JhZSAxMDA2NDQKLS0tIGEvc3JjL21hbi9zc3NkLXNpbXBsZS41Lnht bAorKysgYi9zcmMvbWFuL3Nzc2Qtc2ltcGxlLjUueG1sCkBAIC0xNDQsNiArMTQ0LDIwIEBACiAg ICAgICAgIDwvcGFyYT4KICAgICA8L3JlZnNlY3QxPgogCisgICAgPHJlZnNlY3QxIGlkPSdub3Rl cyc+CisgICAgICAgIDx0aXRsZT5OT1RFUzwvdGl0bGU+CisgICAgICAgIDxwYXJhPgorICAgICAg ICAgIFRoZSBjb21wbGV0ZSBncm91cCBtZW1iZXJzaGlwIGhpZXJhcmNoeSBpcyByZXNvbHZlZAor ICAgICAgICAgIGJlZm9yZSB0aGUgYWNjZXNzIGNoZWNrLCB0aHVzIGV2ZW4gbmVzdGVkIGdyb3Vw cyBjYW4gYmUKKyAgICAgICAgICBpbmNsdWRlZCBpbiB0aGUgYWNjZXNzIGxpc3RzLiAgUGxlYXNl IGJlIGF3YXJlIHRoYXQgdGhlCisgICAgICAgICAgPHF1b3RlPmxkYXBfZ3JvdXBfbmVzdGluZ19s ZXZlbDwvcXVvdGU+IG9wdGlvbiBtYXkgaW1wYWN0IHRoZQorICAgICAgICAgIHJlc3VsdHMgYW5k IHNob3VsZCBiZSBzZXQgdG8gYSBzdWZmaWNpZW50IHZhbHVlLgorICAgICAgICAgICg8Y2l0ZXJl ZmVudHJ5PgorICAgICAgICAgICAgICAgPHJlZmVudHJ5dGl0bGU+c3NzZC1sZGFwPC9yZWZlbnRy eXRpdGxlPjxtYW52b2xudW0+NTwvbWFudm9sbnVtPgorICAgICAgICAgIDwvY2l0ZXJlZmVudHJ5 Pikgb3B0aW9uLgorICAgICAgICA8L3BhcmE+CisgICAgPC9yZWZzZWN0MT4KKwogICAgIDx4aTpp bmNsdWRlIHhtbG5zOnhpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hJbmNsdWRlIiBocmVmPSJp bmNsdWRlL3NlZWFsc28ueG1sIiAvPgogCiA8L3JlZmVudHJ5PgotLSAKMS45LjAKCg== --===============0890920182042667340==--