[SSSD] [PATCH] Add host access control support
Jan Zelený
jzeleny at redhat.com
Wed Mar 23 13:17:49 UTC 2011
Jakub Hrozek <jhrozek at redhat.com> wrote:
> On 03/02/2011 10:39 AM, Jan Zelený wrote:
> > I'm sending rebased patch by Pierre Ossman. The patch is adding an option
> > to allow/deny user access based on host attribute supported by pam_ldap.
> >
> > I tested the patch and it works just fine. I also have no objections to
> > the design.
> >
> > https://fedorahosted.org/sssd/ticket/746
>
> Looks mostly OK to me and works. I have only some nitpicks:
>
> Can we use some other name than SYSDB_HOST? It seems too generic,
> perhaps SYSDB_AUTHORIZED_HOST? The same for SDAP_AT_HOST and name of
the
> config option (something like ldap_user_authorized_host?).
Corrected patch in attachment
Jan
>
> Also, I think it would be nice to canonicalize the hostname we get from
> gethostname() in the same way pam_ldap does it. But in order to avoid
> having to resolve the hostname on every access check, we should
> canonicalize the hostname on startup provider and use it inside the
> provider. (and refresh on going online etc..)
>
> This is being tracked as https://fedorahosted.org/sssd/ticket/815
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-02-Add-host-access-control-support.patch
Type: text/x-patch
Size: 14582 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110323/0ad8b618/attachment.bin>
More information about the sssd-devel
mailing list