On 06/14/2016 05:21 PM, Petr Cech wrote:
Hello list,
there is patch set attached resolving: https://fedorahosted.org/sssd/ticket/2828
You can also see: https://github.com/celestian/sssd/commits/subdomains_v2
This patch set is without tests yet. I will send tests after Pavel B. refactor of AD provider.
I would like to remark couple of things:
Option ad_enabled_domains disabled by default.
We use labels master domain and root domain in code. Master domain
belongs to one that SSSD is connected to. Root domain means AD forest root.
- There is a lot of different environment setup. So this option has
slightly different meaning in each of them.
- There is secret feature if you forget fill in master domain to the
option it will be added automatically.
What is this option good for? Let's imagine environment like:
A (forest root) | |-- S1 (SSSD client) | |-- B (AD client) | | | |-- S2 (SSSD client) | |-- C (AD client) | |-- D (AD client)
A ... forest root B, C, D ... AD clients S1 ... SSSD client connected to A S2 ... SSSD client connected to B
We could write:
- on S1: ad_enabled_domain = A, B, C
and then S1 will not attempt to connect D.
- on S1: ad_enabled_domain = B, C
the same as above because A is automagically filled in.
- on S2: ad_enabled_domain = A, C
and then B is filled in automatically and S2 will not attempt to connect D.
- on S2: ad_enabled_domain = C
and then B is filled in automatically and S2 will not attempt to connect D and A. (I am wondering that it is possible but it happened during manual testing.)
Hello list,
I rebased this patch set due to refactoring of the data provider. New patch set is attached.
I will add tests, I hope soon :-)
Regards