[SSSD] ldap_access_filter

Arturo Borrero aborrero at cica.es
Fri Jan 24 13:44:49 UTC 2014


Hi there!

I've been playing with the SSSD 'ldap_acces_filter' directive.

access_provider = ldap
ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com

I expected a similar functionality to the old ldap.conf:

pam_groupdn cn=HOSTNAME,ou=hosts,dc=example,dc=com
pam_member_attribute member

In the old case, a query was issued to the LDAP backend looking for a 
member within cn=HOSTNAME,ou=hosts,dc=example,dc=com (the host object).

In the new case (SSSD), this query is made (excerpt from my OpenLDAP 
server):

SRCH base="uid=aborrero,ou=users,dc=example,dc=com" scope=0 deref=0 
filter="(&(uid=aborrero)(objectClass=posixAccount)(member=cn=centos6,ou=hosts,dc=example,dc=com))"

This means that SSSD is looking inside the user object, instead of the 
host object.

In sssd-ldap(5) I don't see any additional options to configure this 
behavior.

To migrate to SSSD I would require to filter member which are declared 
within host objects.

Could you please give me some advices about this?

Also, please point me to the right mailing list if this is not the one.

regards.

-- 
Arturo Borrero González
Departamento de Seguridad Informática (nis at cica.es)
Centro Informático Científico de Andalucía (CICA)
Avda. Reina Mercedes s/n - 41012 - Sevilla (Spain)
Tfno.: +34 955 056 600 / FAX: +34 955 056 650
Consejería de Economía, Innovación, Ciencia y Empleo
Junta de Andalucía

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3072 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140124/2d434641/attachment.p7s>


More information about the sssd-devel mailing list