>From 7b7532f68058dfad4122890743041973bb6bdfc6 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 2 Oct 2013 17:48:49 +0200 Subject: [PATCH 3/6] AD: Add a new option ad_access_filter This patch just adds the option, it doesn't do anything useful yet. Related: https://fedorahosted.org/sssd/ticket/2082 --- src/config/etc/sssd.api.d/sssd-ad.conf | 1 + src/man/sssd-ad.5.xml | 24 ++++++++++++++++++++++++ src/providers/ad/ad_common.h | 1 + src/providers/ad/ad_opts.h | 1 + 4 files changed, 27 insertions(+) diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf index 120c827523d5b103396b3a38bca8cc75b25d0cc2..9f606f6c4da65d4bfb20a97ee27801dac9307868 100644 --- a/src/config/etc/sssd.api.d/sssd-ad.conf +++ b/src/config/etc/sssd.api.d/sssd-ad.conf @@ -4,6 +4,7 @@ ad_server = str, None, false ad_backup_server = str, None, false ad_hostname = str, None, false ad_enable_dns_sites = bool, None, false +ad_access_filter = str, None, false ldap_uri = str, None, false ldap_backup_uri = str, None, false ldap_search_base = str, None, false diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml index 3aa865ab110bf93afb08ccf2ee8ca7e62a86a3f7..41bd3ba0536bcc3038eea6befecf84f882aa5d30 100644 --- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml @@ -169,6 +169,30 @@ ldap_id_mapping = False + ad_access_filter (boolean) + + + This option specifies LDAP access control + filter that the user must match in order + to be allowed access. Please note that the + access_filter option must be + explicitly set to ad in order + for this option to have an effect. + + + Example: + + +access_provider = ad +ad_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com + + + Default: Not set + + + + + dyndns_update (boolean) diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h index 98aeb2165273b5dbfafd3b8757180d74b4504c98..b8b73c042b8a5433f720c89c04447c07cd3eac43 100644 --- a/src/providers/ad/ad_common.h +++ b/src/providers/ad/ad_common.h @@ -41,6 +41,7 @@ enum ad_basic_opt { AD_KEYTAB, AD_KRB5_REALM, AD_ENABLE_DNS_SITES, + AD_ACCESS_FILTER, AD_OPTS_BASIC /* opts counter */ }; diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h index f3b6cd61632601ec92a408a6a73cff6446fd48bf..8022a16274a04389b7a64b491ec28a0c3c55aaef 100644 --- a/src/providers/ad/ad_opts.h +++ b/src/providers/ad/ad_opts.h @@ -35,6 +35,7 @@ struct dp_option ad_basic_opts[] = { { "krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING}, { "ad_enable_dns_sites", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE }, + { "ad_access_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING}, DP_OPTION_TERMINATOR }; -- 1.8.3.1