Interesting, thanks. I had tried the simple provider but this didn't restrict access.
Since the docs noted that it didn't honor the "expired" expired attribute I
didn't look into it any closer. I'll try this again and look through debug logs
to see where it broke down; potentially my groups aren't being resolved yet. Are you
saying that the simple provider iterates group membership, which in turn SSSD-LDAP should
be returning?
-nik
-----Original Message-----
From: Jakub Hrozek [mailto:jhrozek@redhat.com]
Sent: Thursday, November 23, 2017 2:47 PM
To: sssd-users(a)lists.fedorahosted.org
Subject: [SSSD-users] Re: ad_access_filter question
On Wed, Nov 22, 2017 at 07:56:57PM +0000, Conwell, Nik wrote:
Hi all, I'm jumping in to using sssd-ad here at BU. I'm able
to domain join a CentOS7 and pull our AD entries successfully but am having troubles with
ad_access_filter to restrict access to a group.
Due to FERPA restrictions here, we can't query memberOf for random people via a
machine account, so things like:
ad_access_filter =
(memberOf=CN=group-of-admins,OU=XYZ,DC=blah,DC=blah,DC=blah)
won't work. I see from debug level 7 that this translates into a query like:
[snip]
Would:
access_provider = simple
simple_allow_groups = group-of-admins do the trick for you?
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org To unsubscribe send an email
to sssd-users-leave(a)lists.fedorahosted.org