On Mon, Jun 02, 2014 at 08:22:14AM -0400, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/01/2014 04:09 PM, Jakub Hrozek wrote:
> On Fri, May 30, 2014 at 06:04:01PM +0200, Pavel Reichl wrote:
>> OK, please see updated patch. PR
>
> Thank you, from content point of view, this looks correct to me.
>
> Can you please ping some native English speaker before I push the
> patch? There are two parts below that I'm not sure about, but as I
> said, it's not about content, just ironing out the language.
>
> [snip]
>
>> @@ -1776,7 +1776,14 @@ users being denied access. Use
>> access_provider = permit to change this default behavior. Please
>> note that this filter is applied on -
>> the LDAP user entry only. + the LDAP
>> user entry only and thus filtering based +
>> on nested groups may not work (e.g. memberOf +
>> attribute on AD entries points only on direct
"points only *to* direct parents"
>> + parents). If nested group based
>> filtering is + desired please see
>
"If filtering based on nested groups is required, please see"
> Maybe required instead of desired?
>
>> + <citerefentry> +
>>
<refentrytitle>sssd-simple</refentrytitle><manvolnum>5</manvolnum>
>>
>>
+ </citerefentry>.
>> </para> <para> Example: diff --git a/src/man/sssd-simple.5.xml
>> b/src/man/sssd-simple.5.xml index
>>
8f94990da9d94dca2f6b5730aaab6b4468fed487..5a0af337e3a45175aaa7a1a36fae5c1da2ead0c4
>> 100644 --- a/src/man/sssd-simple.5.xml +++
>> b/src/man/sssd-simple.5.xml @@ -144,6 +144,18 @@ </para>
>> </refsect1>
>>
>> + <refsect1 id='notes'> +
<title>NOTES</title> +
>> <para> + The complete group memberships are resolved
>> before the access check,
>
> I'm not sure if "group memberships are" should read "group
> membership is", iow if it's better to use singular or plural
> here..
>
"The complete group membership hierarchy is resolved before the access
check, thus even nested groups..."
>> + so even nested groups can be included in the access
>> lists. Please be + aware of ldap_group_nesting_level
"Please be aware that the 'ldap_group_nesting_level' option may impact
the results and should be set to a sufficient value."
Thanks for the review!
Pavel is not around today, so I took the liberty of updating the patch
with your suggestions so we can move forward.