Jakub Hrozek <jhrozek(a)redhat.com> wrote:
On 03/02/2011 10:39 AM, Jan Zelený wrote:
> I'm sending rebased patch by Pierre Ossman. The patch is adding an option
> to allow/deny user access based on host attribute supported by pam_ldap.
>
> I tested the patch and it works just fine. I also have no objections to
> the design.
>
>
https://fedorahosted.org/sssd/ticket/746
Looks mostly OK to me and works. I have only some nitpicks:
Can we use some other name than SYSDB_HOST? It seems too generic,
perhaps SYSDB_AUTHORIZED_HOST? The same for SDAP_AT_HOST and name of
the
config option (something like ldap_user_authorized_host?).
Corrected patch in attachment
Jan
Also, I think it would be nice to canonicalize the hostname we get from
gethostname() in the same way pam_ldap does it. But in order to avoid
having to resolve the hostname on every access check, we should
canonicalize the hostname on startup provider and use it inside the
provider. (and refresh on going online etc..)
This is being tracked as
https://fedorahosted.org/sssd/ticket/815