On Mon, Feb 29, 2016 at 05:05:41PM +0100, Jakub Hrozek wrote:
On Mon, Feb 29, 2016 at 04:23:18PM +0100, Jan Pazdziora wrote:
I don't really like this approach. You won't be able to do an "OR" operation, granting access to users from group1 and from group2 (meaning, user in either of those groups but not necessarily in both). Yes, you likely could create separate nested user group for that but the problem is, in many environments the application admin will have enough problems getting the IPA admins create the HBAC rules for them, but creating the extra user groups might be frowned upon by their IT department.
I must be missing something, why can't you add both groups to the rule?
(The rules with URIs would match with an AND, the objects referenced in the rules already match with an OR..)
Ah, got it. I thought you had an AND in the rules as well.
Sorry about the noise.