[SSSD] [sssd][pathces] MAN: nested group membership
Stephen Gallagher
sgallagh at redhat.com
Mon Jun 2 12:22:14 UTC 2014
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/01/2014 04:09 PM, Jakub Hrozek wrote:
> On Fri, May 30, 2014 at 06:04:01PM +0200, Pavel Reichl wrote:
>> OK, please see updated patch. PR
>
> Thank you, from content point of view, this looks correct to me.
>
> Can you please ping some native English speaker before I push the
> patch? There are two parts below that I'm not sure about, but as I
> said, it's not about content, just ironing out the language.
>
> [snip]
>
>> @@ -1776,7 +1776,14 @@ users being denied access. Use
>> access_provider = permit to change this default behavior. Please
>> note that this filter is applied on -
>> the LDAP user entry only. + the LDAP
>> user entry only and thus filtering based +
>> on nested groups may not work (e.g. memberOf +
>> attribute on AD entries points only on direct
"points only *to* direct parents"
>> + parents). If nested group based
>> filtering is + desired please see
>
"If filtering based on nested groups is required, please see"
> Maybe required instead of desired?
>
>> + <citerefentry> +
>> <refentrytitle>sssd-simple</refentrytitle><manvolnum>5</manvolnum>
>>
>>
+ </citerefentry>.
>> </para> <para> Example: diff --git a/src/man/sssd-simple.5.xml
>> b/src/man/sssd-simple.5.xml index
>> 8f94990da9d94dca2f6b5730aaab6b4468fed487..5a0af337e3a45175aaa7a1a36fae5c1da2ead0c4
>> 100644 --- a/src/man/sssd-simple.5.xml +++
>> b/src/man/sssd-simple.5.xml @@ -144,6 +144,18 @@ </para>
>> </refsect1>
>>
>> + <refsect1 id='notes'> + <title>NOTES</title> +
>> <para> + The complete group memberships are resolved
>> before the access check,
>
> I'm not sure if "group memberships are" should read "group
> membership is", iow if it's better to use singular or plural
> here..
>
"The complete group membership hierarchy is resolved before the access
check, thus even nested groups..."
>> + so even nested groups can be included in the access
>> lists. Please be + aware of ldap_group_nesting_level
"Please be aware that the 'ldap_group_nesting_level' option may impact
the results and should be set to a sufficient value."
>> + (<citerefentry> +
>> <refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum>
>> + </citerefentry>) option. + </para> +
>> </refsect1> + <xi:include
>> xmlns:xi="http://www.w3.org/2001/XInclude"
>> href="include/seealso.xml" />
>>
>> </refentry> -- 1.8.4.2
>>
> _______________________________________________ sssd-devel mailing
> list sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlOMbHYACgkQeiVVYja6o6MmEgCgleOqYdaa1kTpz3JUx/L45Nt+
OY0An24Y0gorpVQHKqshnDzPfDfrMOyX
=Z7Ul
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list