[SSSD] [PATCH] man: document the need to set ldap_access_order
Jakub Hrozek
jhrozek at redhat.com
Mon Jun 10 12:32:51 UTC 2013
On Mon, Jun 10, 2013 at 08:20:25AM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Mon 10 Jun 2013 07:09:32 AM EDT, Ondrej Kos wrote:
> > On 06/09/2013 01:41 PM, Jakub Hrozek wrote:
> >> https://fedorahosted.org/sssd/ticket/1789
> >>
> >> ldap_access_order must be set in order to non-default access
> >> control options to work. This patch amends the sssd-ldap man page
> >> to document this fact with all non-default ldap_access_order
> >> options.
>
> >
> > Ack from me, but some native speaker might check it as well,
> > Stephen?
> >
> >
> >
>
>
> The language looks fine. Ack
>
>
> I can't help but wonder if we should change the defaults of
> ldap_access_order to be
>
> If ldap_access_filter has been set:
> ldap_access_order = expire, filter
>
> Otherwise:
> ldap_access_order = expire
>
>
> With this change, we could probably switch over to having the default
> value for the access_provider be the id_provider, since the LDAP case
> was the primary one that was at issue (since the default configuration
> would not work).
I like the idea of inheriting the value of id_provider, especially
because of the AD provider.
Would you like to open a ticket or shall I?
More information about the sssd-devel
mailing list