[SSSD] [PATCH] man: document the need to set ldap_access_order

Jakub Hrozek jhrozek at redhat.com
Mon Jun 10 12:32:51 UTC 2013


On Mon, Jun 10, 2013 at 08:20:25AM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Mon 10 Jun 2013 07:09:32 AM EDT, Ondrej Kos wrote:
> > On 06/09/2013 01:41 PM, Jakub Hrozek wrote:
> >> https://fedorahosted.org/sssd/ticket/1789
> >> 
> >> ldap_access_order must be set in order to non-default access
> >> control options to work. This patch amends the sssd-ldap man page
> >> to document this fact with all non-default ldap_access_order
> >> options.
> 
> > 
> > Ack from me, but some native speaker might check it as well,
> > Stephen?
> > 
> > 
> > 
> 
> 
> The language looks fine. Ack
> 
> 
> I can't help but wonder if we should change the defaults of
> ldap_access_order to be
> 
> If ldap_access_filter has been set:
> ldap_access_order = expire, filter
> 
> Otherwise:
> ldap_access_order = expire
> 
> 
> With this change, we could probably switch over to having the default
> value for the access_provider be the id_provider, since the LDAP case
> was the primary one that was at issue (since the default configuration
> would not work).

I like the idea of inheriting the value of id_provider, especially
because of the AD provider.

Would you like to open a ticket or shall I?



More information about the sssd-devel mailing list