[SSSD] [PATCH] MAN: Clarify the ldap_access_filter option further

Stephen Gallagher sgallagh at redhat.com
Wed Feb 26 16:14:33 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
> On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
>> The attached patch addresses: 
>> https://fedorahosted.org/sssd/ticket/2235
>> 
>> The memberof example was misleading and was making aministrators
>> think that the ldap_access_filter can resolve nested group
>> memberships.
>> 
>> The alternative I was considering was changing the example to use
>> a different attribute altogether, but I was struggling to come up
>> with an example that wouldn't be too artificial (like 
>> ldap_access_filter=/bin/bash).
> 
> Stephen's review seems to be stuck in mailman queue, so I'm sending
> a patch that contains his suggestion as a reply to myself.
> 
> The employeeType attribute Stephen suggested is a good choice, I
> think.
> 

If we're changing the cited example, I'm not sure we need to call out
the memberOf example anymore.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlMOEukACgkQeiVVYja6o6OPEgCdET71XFoS19OAUPlDt/YMjqyV
jiYAoIHSQq0y4tgCpArlHqPY0cMT2Z8K
=TL8d
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list