----- Original Message -----
From: "Jakub Hrozek" <jhrozek(a)redhat.com>
To: sssd-devel(a)lists.fedorahosted.org
Sent: Monday, May 4, 2015 3:25:42 PM
Subject: Re: [SSSD] [PRELIMINARY][PATCH] ifp users and groups
On Mon, May 04, 2015 at 02:51:57PM +0200, Pavel Březina wrote:
> New patches are attached.
Thanks a lot for the patches!
> All review-issues should be addressed. Those
> patches contains also extraAttributes, group members and user attributes
> acl.
>
> Do we want to implement group attributes acl also?
For which attributes exactly? I think all information that is reachable
using the NSS calls can be published by default, but no other
information should.
Exactly - by default. That means it should be configurable, I guess :-) It is not a
problem to introduce 'group_attributes', an analogy to 'user_attributes'.
But of course, we don't support any extra attributes for group objects (at least not
at the moment).
>
> The groups and users attributes on group object do not reply with full
> recursive membership at the moment since we do not store in on groups
> object
> in sysdb... is it possible to leave it this way or should I compute the
> membership? Sysdb only contains full user members (in memberuid attribute),
> but it contains only direct group members (in member attribute).
>
I guess user members are good enough for now. But we should open and
defer a ticket.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel