[SSSD] [PATCH] MAN: Clarify the ldap_access_filter option further
Jakub Hrozek
jhrozek at redhat.com
Wed Feb 26 16:22:51 UTC 2014
On Wed, Feb 26, 2014 at 11:14:33AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
> > On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
> >> The attached patch addresses:
> >> https://fedorahosted.org/sssd/ticket/2235
> >>
> >> The memberof example was misleading and was making aministrators
> >> think that the ldap_access_filter can resolve nested group
> >> memberships.
> >>
> >> The alternative I was considering was changing the example to use
> >> a different attribute altogether, but I was struggling to come up
> >> with an example that wouldn't be too artificial (like
> >> ldap_access_filter=/bin/bash).
> >
> > Stephen's review seems to be stuck in mailman queue, so I'm sending
> > a patch that contains his suggestion as a reply to myself.
> >
> > The employeeType attribute Stephen suggested is a good choice, I
> > think.
> >
>
> If we're changing the cited example, I'm not sure we need to call out
> the memberOf example anymore.
Hmm, initially I wanted to keep it in, because memberOf is what I see
used mostly in the field but you're right that when I don't think about
the context of the change and just read the man page text, it is
confusing to start talking about memberOf.
Another iteration of the patch is attached.
-------------- next part --------------
>From 4fcfc3a8cbf2c7cf4ec22efe58cce3043cac49bd Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 24 Feb 2014 19:42:23 +0100
Subject: [PATCH] MAN: Clarify the ldap_access_filter option further
https://fedorahosted.org/sssd/ticket/2235
The memberof example was misleading and was making aministrators think
that the ldap_access_filter can resolve nested group memberships.
---
src/man/sssd-ldap.5.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 9e572836d79d84615712943382b0348ecc544e61..747fa7ee3b2f1f785ddefdaa149c596bd21da683 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1782,7 +1782,7 @@
</para>
<programlisting>
access_provider = ldap
-ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
+ldap_access_filter = (employeeType=admin)
</programlisting>
<para>
This example means that access to this host is
--
1.8.5.3
More information about the sssd-devel
mailing list