On Mon, May 12, 2014 at 11:34:44PM +0300, Eugene Istomin wrote:
Hello,
Is it possible to set constant value for authorized_service in the domain
configuration?
Like :
[domain/sshd]
...
ldap_access_order = authorized_service
authorized_services = sshd
...
Thanks!
---
Best regards,
Eugene Istomin
Hi,
are you looking for access control based on the PAM service? If so,
we're planning to work on this during the 1.12 cycle (underway now):
https://fedorahosted.org/sssd/ticket/1021
The title of the bug is a bit misleading, but scroll down through the
comments to read the full proposal.
Right now, SSSD only supports the access control based on authorized
services in user's LDAP entry, as documented in the sssd-ldap man page:
ldap_user_authorized_service (string)
If access_provider=ldap and ldap_access_order=authorized_service, SSSD will use the
presence of the authorizedService attribute in the user's LDAP entry to determine
access
privilege.
An explicit deny (!svc) is resolved first. Second, SSSD searches for explicit allow
(svc)
and finally for allow_all (*).
Please note that the ldap_access_order configuration option must include
“authorized_service” in order for the ldap_user_authorized_service option to work.
Default: authorizedService