-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/02/2011 10:39 AM, Jan Zelený wrote:
I'm sending rebased patch by Pierre Ossman. The patch is adding
an option to
allow/deny user access based on host attribute supported by pam_ldap.
I tested the patch and it works just fine. I also have no objections to the
design.
https://fedorahosted.org/sssd/ticket/746
Looks mostly OK to me and works. I have only some nitpicks:
Can we use some other name than SYSDB_HOST? It seems too generic,
perhaps SYSDB_AUTHORIZED_HOST? The same for SDAP_AT_HOST and name of the
config option (something like ldap_user_authorized_host?).
Also, I think it would be nice to canonicalize the hostname we get from
gethostname() in the same way pam_ldap does it. But in order to avoid
having to resolve the hostname on every access check, we should
canonicalize the hostname on startup provider and use it inside the
provider. (and refresh on going online etc..)
This is being tracked as
https://fedorahosted.org/sssd/ticket/815
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk1w2u8ACgkQHsardTLnvCXQxACghsuRm++yQ2PPGeJhNoC7RmVh
K9MAoLpiiDvTDU4bscIqr7wuqpSnBA7H
=4jUO
-----END PGP SIGNATURE-----