[SSSD] [PATCH] MAN: Clarify the ldap_access_filter option further

Jakub Hrozek jhrozek at redhat.com
Wed Feb 26 16:45:51 UTC 2014


On Wed, Feb 26, 2014 at 05:30:55PM +0100, Jakub Hrozek wrote:
> On Wed, Feb 26, 2014 at 05:22:51PM +0100, Jakub Hrozek wrote:
> > On Wed, Feb 26, 2014 at 11:14:33AM -0500, Stephen Gallagher wrote:
> > > -----BEGIN PGP SIGNED MESSAGE-----
> > > Hash: SHA1
> > > 
> > > On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
> > > > On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
> > > >> The attached patch addresses: 
> > > >> https://fedorahosted.org/sssd/ticket/2235
> > > >> 
> > > >> The memberof example was misleading and was making aministrators
> > > >> think that the ldap_access_filter can resolve nested group
> > > >> memberships.
> > > >> 
> > > >> The alternative I was considering was changing the example to use
> > > >> a different attribute altogether, but I was struggling to come up
> > > >> with an example that wouldn't be too artificial (like 
> > > >> ldap_access_filter=/bin/bash).
> > > > 
> > > > Stephen's review seems to be stuck in mailman queue, so I'm sending
> > > > a patch that contains his suggestion as a reply to myself.
> > > > 
> > > > The employeeType attribute Stephen suggested is a good choice, I
> > > > think.
> > > > 
> > > 
> > > If we're changing the cited example, I'm not sure we need to call out
> > > the memberOf example anymore.
> > 
> > Hmm, initially I wanted to keep it in, because memberOf is what I see
> > used mostly in the field but you're right that when I don't think about
> > the context of the change and just read the man page text, it is
> > confusing to start talking about memberOf.
> > 
> > Another iteration of the patch is attached.
> 
> Yet another version that retains a part of the paragraph (.."applied on
> the LDAP entry only..") and changes description of the example.

And now with the correct patch..
-------------- next part --------------
>From 8dfc7e322bd2062289f520b0a67aba7e463da776 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 24 Feb 2014 19:42:23 +0100
Subject: [PATCH] MAN: Clarify the ldap_access_filter option further

https://fedorahosted.org/sssd/ticket/2235

The memberof example was misleading and was making aministrators think
that the ldap_access_filter can resolve nested group memberships.
---
 src/man/sssd-ldap.5.xml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 9e572836d79d84615712943382b0348ecc544e61..f93b418c45d9bcd32499860a858c3f829bb245ca 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1775,19 +1775,20 @@
                             and this option is not set, it will result in all
                             users being denied access.
                             Use access_provider = permit to change this default
-                            behavior.
+                            behavior. Please note that this filter is applied on
+                            the LDAP user entry only.
                         </para>
                         <para>
                             Example:
                         </para>
                         <programlisting>
 access_provider = ldap
-ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
+ldap_access_filter = (employeeType=admin)
                         </programlisting>
                         <para>
                             This example means that access to this host is
-                            restricted to members of the "allowedusers" group
-                            in ldap.
+                            restricted to users whose employeeType
+                            attribute is set to "admin".
                         </para>
                         <para>
                             Offline caching for this feature is limited to
-- 
1.8.5.3



More information about the sssd-devel mailing list