[SSSD] Design Discussion: Improving AD provider access control

Pavel Březina pbrezina at redhat.com
Fri Sep 20 09:01:45 UTC 2013


On 09/16/2013 03:34 PM, Jakub Hrozek wrote:
> On Mon, Sep 16, 2013 at 10:15:58AM +0200, Pavel Březina wrote:
>> On 09/13/2013 02:57 PM, Jakub Hrozek wrote:
>>> Hi,
>>>
>>> I created a design page that describes a proposed way of improving the
>>> current AD provider access control. The main ticket that tracks the work
>>> is https://fedorahosted.org/sssd/ticket/2082 and the full design page
>>> can be found here:
>>> https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryAccessControl
>>>
>>> Comments and review are mostly welcome.
>>
>> Hi,
>> good job creating this design page. It is simple, straightforward
>> and I don't see anything to object to :-).
>>
>> Ack.
>
> What do you think about the extended filter? Do you think it's handy or
> too much for v1 ?

I think it is quite mandatory even for first version (at least domain 
component). You need to be able to configure different access filter 
for main domain and trusted domains.

However, this made me thinking... it is a future call but we should 
provide a way to allow configuration of subdomains. Something like 
[domain/maindomain/subdomain] section in sssd.conf?




More information about the sssd-devel mailing list