Because just about everyone in our organization will have the POSIX
attributes, but we don't want everyone to be able to log into every
server. For example, we have bankers that will ONLY log into our
origination system, the engineers and admins log in everywhere, the devs
log into dev and sometimes test but not prod or staging, etc.
We're using netgroups to control this now, but that isŠ icky.
--
Greg Wojtak
Senior Unix Systems Engineer
Office: (313) 373-4306
Mobile: (734) 718-8472
On 5/9/13 9:26 AM, "Ondrej Valousek" <ovalousek(a)vendavo.com> wrote:
What about configuring sssd to make use of the POSIX attributes in AD
and
define those attributes only for people you want to allow in?
Sound the easiest form to me.
Ondrej
-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Wojtak,
Greg (Superfly)
Sent: Thursday, May 09, 2013 3:09 PM
To: End-user discussions about the System Security Services Daemon
Subject: [SSSD-users] Nested Groups in ldap_access_filter?
I'm trying to set up sssd with access_provider = ldap. I'm having a
little trouble getting the ldap_access_filter working the way I want to.
The way I want to do it is to create a Resource Group in AD that contains
the Unix Team group and then whichever users need access to the system.
So we'd have, say:
cn=Server1AccessGroup,ou=Groups,Š.
member: cn=Unix Team,ou=Groups,Š
member: cn=User A,Š
member: cn=User B,Š
Is there a way to craft the ldap_access_filter based on the above such
that the members of Unix Team and then the two users will be allowed
access?
As an ancillary question to this, I'd like some clarification of how
ldap_access_filter works exactly. Is it simply that the user's DN who is
trying to login needs to match a result of the query specified in the
access filter line?
Thanks!
--
Greg Wojtak
Senior Unix Systems Engineer
Office: (313) 373-4306
Mobile: (734) 718-8472
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users