[SSSD] [PATCH] man: document the need to set ldap_access_order

Jakub Hrozek jhrozek at redhat.com
Mon Jun 10 18:58:33 UTC 2013


On Mon, Jun 10, 2013 at 02:32:51PM +0200, Jakub Hrozek wrote:
> On Mon, Jun 10, 2013 at 08:20:25AM -0400, Stephen Gallagher wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > On Mon 10 Jun 2013 07:09:32 AM EDT, Ondrej Kos wrote:
> > > On 06/09/2013 01:41 PM, Jakub Hrozek wrote:
> > >> https://fedorahosted.org/sssd/ticket/1789
> > >> 
> > >> ldap_access_order must be set in order to non-default access
> > >> control options to work. This patch amends the sssd-ldap man page
> > >> to document this fact with all non-default ldap_access_order
> > >> options.
> > 
> > > 
> > > Ack from me, but some native speaker might check it as well,
> > > Stephen?
> > > 
> > > 
> > > 
> > 
> > 
> > The language looks fine. Ack
> > 
> > 
> > I can't help but wonder if we should change the defaults of
> > ldap_access_order to be
> > 
> > If ldap_access_filter has been set:
> > ldap_access_order = expire, filter
> > 
> > Otherwise:
> > ldap_access_order = expire
> > 
> > 
> > With this change, we could probably switch over to having the default
> > value for the access_provider be the id_provider, since the LDAP case
> > was the primary one that was at issue (since the default configuration
> > would not work).
> 
> I like the idea of inheriting the value of id_provider, especially
> because of the AD provider.
> 
> Would you like to open a ticket or shall I?

I took the liberty of filing the ticket:
https://fedorahosted.org/sssd/ticket/1975



More information about the sssd-devel mailing list