On Wed, Sep 29, 2010 at 1:45 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/29/2010 01:02 AM, Jeff Schroeder wrote:
> Not for the sake of being argumentative, but for the sake of
> completeness, why do you want to change the semantics of what an admin
> would expect? Especially when most people using sssd are former
> pam_ldap users and expect things like netgroups to work a certain way?
> While not disagreeing, I'm just curious as to the reasoning.
>
Is that behaviour used in the field, though? In what scenario? (I'm not
a sysadmin, so these are genuine questions..)
Well it really depends on the admin. Personally, if I wanted to
implement the equivalent of netgroups locally, pam_access is the tool
for the job. I was just pointing out that you're going around a
perfectly valid existing configuration and it might be unexpected.
Please make sure to document this feature well.
--
Jeff Schroeder
Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com