On Tue, Jun 30, 2015 at 02:15:27PM +0200, Jan Pazdziora wrote:
> If for the applications realm is also useful, then
> a) the app can query the sssd dbus interface for the matching realm
> for the domain
> b) we can also return the realm, although the expectations should be
> set right in documentation that not all domain types have the realm
> info (LDAP domain for example)
So how about the reverse mapping? Going from realm to SSSD domain /
section? Currently for example in mod_authnz_pam we consider them
interchangeable -- we just take the principal name (either fully
qualified or not) and pass it to pam_sss.so via pam_acct_mgmt to
evaluate the access check. Should we get the SSSD domain / section
value for that?
I've filed
https://fedorahosted.org/sssd/ticket/2709 for some way to
get the SSSD domain based on the realm.
--
Jan Pazdziora
Senior Principal Software Engineer, Identity Management Engineering, Red Hat