[SSSD] [PATCHES] HBAC access control rewrite
Simo Sorce
simo at redhat.com
Fri Jun 24 15:15:40 UTC 2011
On Fri, 2011-06-24 at 09:54 -0400, Stephen Gallagher wrote:
> New patches attached with some significant changes. After much
> discussion, we decided that, rather than implement a facility for
> identifying "unresolved groups" for the user, we would instead perform
> a
> group lookup during the initial pull-down of the HBAC rules. This way,
> we know that all groups that are relevant to HBAC rules are available
> on
> the system. So if a user is a member of a group that is not
> resolvable,
> we don't have to worry that it might match a DENY rule.
NACK
New patches fail to take in account non-posix groups.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list