I would definitely use that ad_access_filter feature. In fact that is how I expected it
was going to work and tried it out originally. It would also be cool if there was a way
to specify users and groups that did not require the whole distinguished name. A
ldap-simple mode if you will. I know there are technical issues that make this hard to
work for group membership. But, that way sssd could authenticate a user or group
regardless if it had been moved to another OU. Maybe by using "pre-Windows
2000" name or SID. It would be more Windows like behavior.
I'm happy to do some testing. Our environment here is CentOS 6.4
On Sep 13, 2013, at 6:04 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
On Mon, Sep 09, 2013 at 09:57:35AM -0700, Doug Clow wrote:
> Thank you Jakub,
> Those settings you gave me to minimally add back the ldap access_provider worked
perfectly. All is working well again!
I'm glad the access control is working for you now. We were thinking
about means to improve the configuration and here is a first version of
the design of proposed access control mechanism:
If you have any comments, please let us know. In particular, as an
admin, would you find the extended filter useful?