On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
Hello,
When one uses SSSD with AD provider but user comes from a subdomain
there are implications for the access provider. AFAIU we have a ticket
for simple access provider:
https://fedorahosted.org/sssd/ticket/2034
but what about other access providers? What are the implications? And
what would be the best practices in configuring SSSD in this case? What
access provider would we recommend?
Yes, I was thinking about these use cases after the recent sssd-users
thread. The exact use-case that was described is very common so I think
we should react.
For the AD provider, I think we might add one more configuration option
"ad_access_filter" that, if set, would augment the AD access provider so
that it first checks if the account is expired and if it's not, then
proceed to check if the account matches the filter without having to
configure the LDAP provider.
I envision a wiki page titled: "HOWTO/Selecting the best access
control
configuration for the SSSD AD provider". That should cover different use
cases and give recommendations based on the use case.
I agree. So I think we should open two tickets -- one for the
documentation and one for the option. Do you agree?