[SSSD] [sssd][pathces] MAN: nested group membership

Stephen Gallagher sgallagh at redhat.com
Mon Jun 2 12:22:14 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/01/2014 04:09 PM, Jakub Hrozek wrote:
> On Fri, May 30, 2014 at 06:04:01PM +0200, Pavel Reichl wrote:
>> OK, please see updated patch. PR
> 
> Thank you, from content point of view, this looks correct to me.
> 
> Can you please ping some native English speaker before I push the 
> patch? There are two parts below that I'm not sure about, but as I
> said, it's not about content, just ironing out the language.
> 
> [snip]
> 
>> @@ -1776,7 +1776,14 @@ users being denied access. Use
>> access_provider = permit to change this default behavior. Please
>> note that this filter is applied on -
>> the LDAP user entry only. +                            the LDAP
>> user entry only and thus filtering based +
>> on nested groups may not work (e.g. memberOf +
>> attribute on AD entries points only on direct

"points only *to* direct parents"

>> +                            parents). If nested group based
>> filtering is +                            desired please see
> 

"If filtering based on nested groups is required, please see"


> Maybe required instead of desired?
> 
>> +                            <citerefentry> +
>> <refentrytitle>sssd-simple</refentrytitle><manvolnum>5</manvolnum>
>>
>> 
+                            </citerefentry>.
>> </para> <para> Example: diff --git a/src/man/sssd-simple.5.xml
>> b/src/man/sssd-simple.5.xml index
>> 8f94990da9d94dca2f6b5730aaab6b4468fed487..5a0af337e3a45175aaa7a1a36fae5c1da2ead0c4
>> 100644 --- a/src/man/sssd-simple.5.xml +++
>> b/src/man/sssd-simple.5.xml @@ -144,6 +144,18 @@ </para> 
>> </refsect1>
>> 
>> +    <refsect1 id='notes'> +        <title>NOTES</title> +
>> <para> +          The complete group memberships are resolved
>> before the access check,
> 
> I'm not sure if "group memberships are" should read "group
> membership is", iow if it's better to use singular or plural
> here..
> 

"The complete group membership hierarchy is resolved before the access
check, thus even nested groups..."


>> +          so even nested groups can be included in the access
>> lists. Please be +          aware of ldap_group_nesting_level


"Please be aware that the 'ldap_group_nesting_level' option may impact
the results and should be set to a sufficient value."


>> +          (<citerefentry> +
>> <refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum> 
>> +          </citerefentry>) option. +        </para> +
>> </refsect1> + <xi:include
>> xmlns:xi="http://www.w3.org/2001/XInclude"
>> href="include/seealso.xml" />
>> 
>> </refentry> -- 1.8.4.2
>> 
> _______________________________________________ sssd-devel mailing
> list sssd-devel at lists.fedorahosted.org 
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlOMbHYACgkQeiVVYja6o6MmEgCgleOqYdaa1kTpz3JUx/L45Nt+
OY0An24Y0gorpVQHKqshnDzPfDfrMOyX
=Z7Ul
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list