[SSSD] SSSD (another) wish-list

Marko Myllynen myllynen at redhat.com
Mon Nov 21 15:47:08 UTC 2011


Hi,

On 2011-11-21 17:21, John Hodrien wrote:
> On Mon, 21 Nov 2011, Stephen Gallagher wrote:
> 
>> Well, I don't know how much of that is happening due to direct
>> modification of LDAP versus using RPC to initiate a routine to make the
>> changes. The latter can at least be validated.
>>
>> Allowing direct access to LDAP attributes means that you have no control
>> over what they become.
> 
> I'm assuming a machine can be updated by an auto-update process and the
> machine will the fields in AD.  In a way, it doesn't matter all that much
> whether that's over RPC or LDAP as far as your hypothetical case goes does it?

when you operate as the user who has privileges to join machines to the
domain you can also do direct modifications of those hosts' LDAP
attributes. However, if you have only the privileges of the principal
from the host keytab, you don't have permissions to change the machine
attributes.

Cheers,

-- 
Marko Myllynen



More information about the sssd-devel mailing list