[SSSD] [PATCHES][PRELIMINARY] Support for multiple LDAP search bases
Stephen Gallagher
sgallagh at redhat.com
Mon Sep 26 13:17:02 UTC 2011
On Mon, 2011-09-26 at 15:10 +0200, Jan Zelený wrote:
> > Patch 0004: Add parser for multiple search bases
> > As discussed on the list, this will the ldap_*_search_base options in
> > the form of:
> > search_base[?scope?[filter][?search_base?scope?[filter]]*]
> > This is backwards-compatible (just use a search base)
>
> Why haven't you used the for cycle to parse search bases? Personally I'd
> prefer it that way, but I guess it is nothing wrong to do it this way either.
> Other than that the patch is fine.
I don't understand the question. Could you explain?
> > Patch 0009: Add support for multiple search bases for initgroups
> > (RFC2307 group portion)
>
> Is this the correct behavior? I mean if we find user, is it correct to look for
> for its initgroups in other search bases than the one we found the user in? It
> doesn't seem right to me.
Yes, in fact this MUST be the correct behavior in order to address the
major use-cases (that of allowing group overrides on a per-host basis).
In other words, you want to be able to have hostA see the group
'dbadmins' as including this user, but on hostB, 'dbadmins' should NOT.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110926/c6135ff3/attachment.sig>
More information about the sssd-devel
mailing list