[SSSD] Announcing SSSD 1.5.14

Stephen Gallagher sgallagh at redhat.com
Thu Nov 3 12:27:02 UTC 2011


On Thu, 2011-11-03 at 09:51 +0100, Jakub Hrozek wrote:
> On Thu, Nov 03, 2011 at 04:08:51PM +1000, GOLLSCHEWSKY, Tim wrote: >
> Are these options used anywhere? > >      ldap_group_search_scope
> >      ldap_group_search_filter > 
> 
> As Jan noted, these options will be deprecated in 1.7 and onwards. But
> even in the current releases, they only limit the initial user/group
> lookup (getent passwd/group), not group membership during initgroups.
> 

I'd like to point out that https://fedorahosted.org/sssd/ticket/960 will
also probably handle this for you. As an add-on to
https://fedorahosted.org/sssd/ticket/868 (which handles multiple search
bases with individual lookup filters), we will be able to properly
filter out users and groups that don't match the search base and filter.

So I think that in 1.7.0, your issue will be solved by doing:

ldap_group_search_base =
dc=example,dc=com?subtree?(|(cn=group1)(cn=group2)(cn=group3))

And the result will be that you will only see groups that match the
aforementioned filter, even for nested groups with DN lookups.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111103/418277bd/attachment.sig>


More information about the sssd-devel mailing list