[SSSD] [PATCH] Add host access control support

Jan Zelený jzeleny at redhat.com
Wed Mar 23 13:17:49 UTC 2011


Jakub Hrozek <jhrozek at redhat.com> wrote:
> On 03/02/2011 10:39 AM, Jan Zelený wrote:
> > I'm sending rebased patch by Pierre Ossman. The patch is adding an option
> > to allow/deny user access based on host attribute supported by pam_ldap.
> > 
> > I tested the patch and it works just fine. I also have no objections to
> > the design.
> > 
> > https://fedorahosted.org/sssd/ticket/746
> 
> Looks mostly OK to me and works. I have only some nitpicks:
> 
> Can we use some other name than SYSDB_HOST? It seems too generic,
> perhaps SYSDB_AUTHORIZED_HOST? The same for SDAP_AT_HOST and name of 
the
> config option (something like ldap_user_authorized_host?).

Corrected patch in attachment

Jan

> 
> Also, I think it would be nice to canonicalize the hostname we get from
> gethostname() in the same way pam_ldap does it. But in order to avoid
> having to resolve the hostname on every access check, we should
> canonicalize the hostname on startup provider and use it inside the
> provider. (and refresh on going online etc..)
> 
> This is being tracked as https://fedorahosted.org/sssd/ticket/815
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-02-Add-host-access-control-support.patch
Type: text/x-patch
Size: 14582 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110323/0ad8b618/attachment.bin>


More information about the sssd-devel mailing list