Hi Jakub,
I would definitely use that ad_access_filter feature. In fact that is how I expected it
was going to work and tried it out originally. It would also be cool if there was a way
to specify users and groups that did not require the whole distinguished name. A
ldap-simple mode if you will. I know there are technical issues that make this hard to
work for group membership. But, that way sssd could authenticate a user or group
regardless if it had been moved to another OU. Maybe by using "pre-Windows
2000" name or SID. It would be more Windows like behavior.
I'm happy to do some testing. Our environment here is CentOS 6.4
Regards,
Doug
On Sep 13, 2013, at 6:04 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
On Mon, Sep 09, 2013 at 09:57:35AM -0700, Doug Clow wrote:
> Thank you Jakub,
>
> Those settings you gave me to minimally add back the ldap access_provider worked
perfectly. All is working well again!
>
> Best,
> Doug
>
>
Hi Doug,
I'm glad the access control is working for you now. We were thinking
about means to improve the configuration and here is a first version of
the design of proposed access control mechanism:
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryAccessControl
If you have any comments, please let us know. In particular, as an
admin, would you find the extended filter useful?