[SSSD] [PATCHES][PRELIMINARY] Support for multiple LDAP search bases

Stephen Gallagher sgallagh at redhat.com
Mon Sep 26 13:17:02 UTC 2011


On Mon, 2011-09-26 at 15:10 +0200, Jan Zelený wrote:
> > Patch 0004: Add parser for multiple search bases
> > As discussed on the list, this will the ldap_*_search_base options in
> > the form of:
> > search_base[?scope?[filter][?search_base?scope?[filter]]*]
> > This is backwards-compatible (just use a search base)
> 
> Why haven't you used the for cycle to parse search bases? Personally I'd 
> prefer it that way, but I guess it is nothing wrong to do it this way either. 
> Other than that the patch is fine.

I don't understand the question. Could you explain?

> > Patch 0009: Add support for multiple search bases for initgroups
> > (RFC2307 group portion)
> 
> Is this the correct behavior? I mean if we find user, is it correct to look for 
> for its initgroups in other search bases than the one we found the user in? It 
> doesn't seem right to me.

Yes, in fact this MUST be the correct behavior in order to address the
major use-cases (that of allowing group overrides on a per-host basis).

In other words, you want to be able to have hostA see the group
'dbadmins' as including this user, but on hostB, 'dbadmins' should NOT.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110926/c6135ff3/attachment.sig>


More information about the sssd-devel mailing list