[SSSD] How to handle ldap_access_filter when offline
Stephen Gallagher
sgallagh at redhat.com
Wed May 12 14:17:17 UTC 2010
I'm working on ticket https://fedorahosted.org/sssd/ticket/457
The idea is that there will be a new access_provider=ldap that will
accept an option "ldap_access_filter". For example "ldap_access_filter =
host=client.example.com"
This would then translate into an LDAP request to see if an ldapsearch
on the search base with the filter
"&(uid=userloggingin)(host=client.example.com)"
returned a valid entry. If it did not, the user would be denied access.
The question is: how do we cache this for offline access. The filter is
an arbitrary LDAP query, so we can't just have the ID provider look up
an attribute when looking up the user and then check that it matches.
My thought is that the simplest approach would be to store in the LDB a
list of users that have successfully passed this access check before. If
and only if we're offline, it should ask this cache.
When we perform an access check while online, if it passes, we should
add the user to this cache. If it fails, we should ensure that the user
is not in the cache.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
More information about the sssd-devel
mailing list