URL:
https://github.com/SSSD/sssd/pull/5693
Author: alexey-tikhonov
Title: #5693: Basics of 'subid ranges' support for IPA provider
Action: edited
Changed field: body
Original value:
"""
This is for preliminary review.
Limitations:
- only IPA provider
- single subid interval pair (subuid+subgid) per user
- idviews aren't supported
- only forward lookup (user -> subid)
Known TODOs:
- delete cached subid ranges in case "not found" on a server
- distinguish "user not found" vs "user doesn't have ranges
defined"
To test:
- build shadow-utils from latest upstream (or get Fedora Rawhide build from
https://copr.fedorainfracloud.org/coprs/ipedrosa/subid_ranges/)
- build FreeIPA with
https://github.com/freeipa/freeipa/pull/5713 (or ping me for
details of internal test setup)
- build SSSD with this PR (enabling `--with-subid`)
- edit /etc/nsswitch.conf: `subid: sss`
- use for example this
[
utility](https://github.com/shadow-maint/shadow/blob/master/src/list_subi... from
shadow-utils upstream to fetch subid ranges from IPA server (or `new?idmap`)
"""