On 01/30/2014 05:35 AM, Denis Kutin wrote:
Dear friends, 

Using sssd, for a long time, I have come across with a problem recently, which I would like to solve with your help.

I provide centralized authentication and authorization service for a huge heterogeneous network. And in my case it would be "nice and easy" if sssd used only shells(5). I believe this mechanism is sufficient for identification of an allowed shell.

I take a liberty to offer you this tiny patch, which will let use wildcard (*) in param allowed_shells in sssd.conf

What do you think about it?

--
Denis Kutin


_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


Thanks for the patch.
But let us start from the beginning. I see the problem that you want to solve so please file ticket so that we can track it for future.

I am not an expert in the code but:
1) The check is inside the loop, it probably should be outside the loop (not sure)
2) Debug message should be different because we want to differentiate from allowed but does not exist.
3) We are saying that we are using user shall but actually returning shall_fallback, is that right?

-- 
be Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/