On Mon, 2011-09-26 at 15:10 +0200, Jan Zelený wrote:
> Patch 0004: Add parser for multiple search bases
> As discussed on the list, this will the ldap_*_search_base options in
> the form of:
> search_base[?scope?[filter][?search_base?scope?[filter]]*]
> This is backwards-compatible (just use a search base)
Why haven't you used the for cycle to parse search bases? Personally I'd
prefer it that way, but I guess it is nothing wrong to do it this way either.
Other than that the patch is fine.
I don't understand the question. Could you explain?
> Patch 0009: Add support for multiple search bases for
initgroups
> (RFC2307 group portion)
Is this the correct behavior? I mean if we find user, is it correct to look for
for its initgroups in other search bases than the one we found the user in? It
doesn't seem right to me.
Yes, in fact this MUST be the correct behavior in order to address the
major use-cases (that of allowing group overrides on a per-host basis).
In other words, you want to be able to have hostA see the group
'dbadmins' as including this user, but on hostB, 'dbadmins' should NOT.