On Mon, May 04, 2015 at 04:42:45PM -0400, Pavel Brezina wrote:
----- Original Message -----
> From: "Jakub Hrozek" <jhrozek(a)redhat.com>
> To: sssd-devel(a)lists.fedorahosted.org
> Sent: Monday, May 4, 2015 3:25:42 PM
> Subject: Re: [SSSD] [PRELIMINARY][PATCH] ifp users and groups
>
> On Mon, May 04, 2015 at 02:51:57PM +0200, Pavel Březina wrote:
> > New patches are attached.
>
> Thanks a lot for the patches!
>
> > All review-issues should be addressed. Those
> > patches contains also extraAttributes, group members and user attributes
> > acl.
> >
> > Do we want to implement group attributes acl also?
>
> For which attributes exactly? I think all information that is reachable
> using the NSS calls can be published by default, but no other
> information should.
Exactly - by default. That means it should be configurable, I guess :-) It is not a
problem to introduce 'group_attributes', an analogy to 'user_attributes'.
But of course, we don't support any extra attributes for group objects (at least not
at the moment).
Yes, we should not implement group_attributes until they are requested.