On Tue, Sep 23, 2014 at 10:03:36AM -0400, Simo Sorce wrote:
I would defer this to when we have actual requests for it.
I am not necessarily opposed but it will be confusing. You see a list
of domains (or even 'none') and then you have to (at least
mentally) parse all the code snippets to find out who can do what.
I think domain snippets, in general, should not influence other
services behavior, but just define the domain itself.
Actually, I've been hoping we could move towards making [domain/...]
and [pam-service/...] and other types not just define what their are,
but also the behaviour of the rest of the sssd towards that object. It
feels a bit more natural to say "for this domain, these users can
consume the identities", than go the other way round.
--
Jan Pazdziora
Principal Software Engineer, Identity Management Engineering, Red Hat