[SSSD] [sssd][pathces] MAN: nested group membership

Jakub Hrozek jhrozek at redhat.com
Sun Jun 1 20:09:56 UTC 2014


On Fri, May 30, 2014 at 06:04:01PM +0200, Pavel Reichl wrote:
> OK, please see updated patch.
> PR

Thank you, from content point of view, this looks correct to me.

Can you please ping some native English speaker before I push the
patch? There are two parts below that I'm not sure about, but as I said,
it's not about content, just ironing out the language.

[snip]

> @@ -1776,7 +1776,14 @@
>                              users being denied access.
>                              Use access_provider = permit to change this default
>                              behavior. Please note that this filter is applied on
> -                            the LDAP user entry only.
> +                            the LDAP user entry only and thus filtering based
> +                            on nested groups may not work (e.g. memberOf
> +                            attribute on AD entries points only on direct
> +                            parents). If nested group based filtering is
> +                            desired please see

Maybe required instead of desired?

> +                            <citerefentry>
> +                              <refentrytitle>sssd-simple</refentrytitle><manvolnum>5</manvolnum>
> +                            </citerefentry>.
>                          </para>
>                          <para>
>                              Example:
> diff --git a/src/man/sssd-simple.5.xml b/src/man/sssd-simple.5.xml
> index 8f94990da9d94dca2f6b5730aaab6b4468fed487..5a0af337e3a45175aaa7a1a36fae5c1da2ead0c4 100644
> --- a/src/man/sssd-simple.5.xml
> +++ b/src/man/sssd-simple.5.xml
> @@ -144,6 +144,18 @@
>          </para>
>      </refsect1>
>  
> +    <refsect1 id='notes'>
> +        <title>NOTES</title>
> +        <para>
> +          The complete group memberships are resolved before the access check,

I'm not sure if "group memberships are" should read "group membership
is", iow if it's better to use singular or plural here..

> +          so even nested groups can be included in the access lists. Please be
> +          aware of ldap_group_nesting_level
> +          (<citerefentry>
> +               <refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum>
> +          </citerefentry>) option.
> +        </para>
> +    </refsect1>
> +
>      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/seealso.xml" />
>  
>  </refentry>
> -- 
> 1.8.4.2
> 



More information about the sssd-devel mailing list