[SSSD] [PATCH] MAN: Clarify the ldap_access_filter option further

Jakub Hrozek jhrozek at redhat.com
Wed Feb 26 15:08:56 UTC 2014


On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
> The attached patch addresses:
> https://fedorahosted.org/sssd/ticket/2235
> 
> The memberof example was misleading and was making aministrators think
> that the ldap_access_filter can resolve nested group memberships.
> 
> The alternative I was considering was changing the example to use a
> different attribute altogether, but I was struggling to come up with an
> example that wouldn't be too artificial (like
> ldap_access_filter=/bin/bash).

Stephen's review seems to be stuck in mailman queue, so I'm sending a
patch that contains his suggestion as a reply to myself.

The employeeType attribute Stephen suggested is a good choice, I think.
-------------- next part --------------
>From 7d74accb1f452d202d4fae524db1a14ebb314df2 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 24 Feb 2014 19:42:23 +0100
Subject: [PATCH] MAN: Clarify the ldap_access_filter option further

https://fedorahosted.org/sssd/ticket/2235

The memberof example was misleading and was making aministrators think
that the ldap_access_filter can resolve nested group memberships.
---
 src/man/sssd-ldap.5.xml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 9e572836d79d84615712943382b0348ecc544e61..46b2972b89915f7f4389487e51af1ed73f279bb7 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1782,7 +1782,7 @@
                         </para>
                         <programlisting>
 access_provider = ldap
-ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
+ldap_access_filter = (employeeType=admin)
                         </programlisting>
                         <para>
                             This example means that access to this host is
@@ -1790,6 +1790,19 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                             in ldap.
                         </para>
                         <para>
+                            Please note that this filter is applied on the
+                            LDAP user entry only. As an example, with many
+                            directory servers (notably Active Directory),
+                            the <quote>memberOf</quote> attribute only
+                            includes the direct membership. If the directory
+                            uses nested groups, the simple access provider
+                            is often a better choice. See
+                            the <citerefentry>
+                                <refentrytitle>sssd-simple</refentrytitle>
+                                <manvolnum>5</manvolnum>
+                            </citerefentry> manual page for more information.
+                        </para>
+                        <para>
                             Offline caching for this feature is limited to
                             determining whether the user's last online login
                             was granted access permission. If they were
-- 
1.8.5.3



More information about the sssd-devel mailing list