[SSSD] [PATCH] MAN: Clarify the ldap_access_filter option further
Stephen Gallagher
sgallagh at redhat.com
Wed Feb 26 16:14:33 UTC 2014
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
> On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
>> The attached patch addresses:
>> https://fedorahosted.org/sssd/ticket/2235
>>
>> The memberof example was misleading and was making aministrators
>> think that the ldap_access_filter can resolve nested group
>> memberships.
>>
>> The alternative I was considering was changing the example to use
>> a different attribute altogether, but I was struggling to come up
>> with an example that wouldn't be too artificial (like
>> ldap_access_filter=/bin/bash).
>
> Stephen's review seems to be stuck in mailman queue, so I'm sending
> a patch that contains his suggestion as a reply to myself.
>
> The employeeType attribute Stephen suggested is a good choice, I
> think.
>
If we're changing the cited example, I'm not sure we need to call out
the memberOf example anymore.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlMOEukACgkQeiVVYja6o6OPEgCdET71XFoS19OAUPlDt/YMjqyV
jiYAoIHSQq0y4tgCpArlHqPY0cMT2Z8K
=TL8d
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list