[SSSD] [sssd][pathces] MAN: nested group membership

Jakub Hrozek jhrozek at redhat.com
Mon Jun 2 13:13:32 UTC 2014


On Mon, Jun 02, 2014 at 08:22:14AM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 06/01/2014 04:09 PM, Jakub Hrozek wrote:
> > On Fri, May 30, 2014 at 06:04:01PM +0200, Pavel Reichl wrote:
> >> OK, please see updated patch. PR
> > 
> > Thank you, from content point of view, this looks correct to me.
> > 
> > Can you please ping some native English speaker before I push the 
> > patch? There are two parts below that I'm not sure about, but as I
> > said, it's not about content, just ironing out the language.
> > 
> > [snip]
> > 
> >> @@ -1776,7 +1776,14 @@ users being denied access. Use
> >> access_provider = permit to change this default behavior. Please
> >> note that this filter is applied on -
> >> the LDAP user entry only. +                            the LDAP
> >> user entry only and thus filtering based +
> >> on nested groups may not work (e.g. memberOf +
> >> attribute on AD entries points only on direct
> 
> "points only *to* direct parents"
> 
> >> +                            parents). If nested group based
> >> filtering is +                            desired please see
> > 
> 
> "If filtering based on nested groups is required, please see"
> 
> 
> > Maybe required instead of desired?
> > 
> >> +                            <citerefentry> +
> >> <refentrytitle>sssd-simple</refentrytitle><manvolnum>5</manvolnum>
> >>
> >> 
> +                            </citerefentry>.
> >> </para> <para> Example: diff --git a/src/man/sssd-simple.5.xml
> >> b/src/man/sssd-simple.5.xml index
> >> 8f94990da9d94dca2f6b5730aaab6b4468fed487..5a0af337e3a45175aaa7a1a36fae5c1da2ead0c4
> >> 100644 --- a/src/man/sssd-simple.5.xml +++
> >> b/src/man/sssd-simple.5.xml @@ -144,6 +144,18 @@ </para> 
> >> </refsect1>
> >> 
> >> +    <refsect1 id='notes'> +        <title>NOTES</title> +
> >> <para> +          The complete group memberships are resolved
> >> before the access check,
> > 
> > I'm not sure if "group memberships are" should read "group
> > membership is", iow if it's better to use singular or plural
> > here..
> > 
> 
> "The complete group membership hierarchy is resolved before the access
> check, thus even nested groups..."
> 
> 
> >> +          so even nested groups can be included in the access
> >> lists. Please be +          aware of ldap_group_nesting_level
> 
> 
> "Please be aware that the 'ldap_group_nesting_level' option may impact
> the results and should be set to a sufficient value."

Thanks for the review!

Pavel is not around today, so I took the liberty of updating the patch
with your suggestions so we can move forward.
-------------- next part --------------
>From ef2218a7b8c5be825555b76eb27b87ec6c7b0f44 Mon Sep 17 00:00:00 2001
From: Pavel Reichl <preichl at redhat.com>
Date: Thu, 10 Apr 2014 16:25:45 +0100
Subject: [PATCH] MAN: hint nested groups by simple access provider

sssd-ldap hints to use the simple access provider if a nested group membership
is needed. Add explicit notice in sssd-simple about support of nested group
membership.

Resolves:
https://fedorahosted.org/sssd/ticket/2308
---
 src/man/sssd-ldap.5.xml   |  9 ++++++++-
 src/man/sssd-simple.5.xml | 14 ++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 6426fe4fca5dc9bb9bc84fcbf633404144052d01..93a7e362a99b0994a7f964f928a394c6588a397f 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1824,7 +1824,14 @@
                             users being denied access.
                             Use access_provider = permit to change this default
                             behavior. Please note that this filter is applied on
-                            the LDAP user entry only.
+                            the LDAP user entry only and thus filtering based
+                            on nested groups may not work (e.g. memberOf
+                            attribute on AD entries points only to direct
+                            parents). If filtering based on nested groups
+                            is required, please see
+                            <citerefentry>
+                              <refentrytitle>sssd-simple</refentrytitle><manvolnum>5</manvolnum>
+                            </citerefentry>.
                         </para>
                         <para>
                             Example:
diff --git a/src/man/sssd-simple.5.xml b/src/man/sssd-simple.5.xml
index 8f94990da9d94dca2f6b5730aaab6b4468fed487..0d677bd293925d9eed0ea16548fad3caf3bb3bae 100644
--- a/src/man/sssd-simple.5.xml
+++ b/src/man/sssd-simple.5.xml
@@ -144,6 +144,20 @@
         </para>
     </refsect1>
 
+    <refsect1 id='notes'>
+        <title>NOTES</title>
+        <para>
+          The complete group membership hierarchy is resolved
+          before the access check, thus even nested groups can be
+          included in the access lists.  Please be aware that the
+          <quote>ldap_group_nesting_level</quote> option may impact the
+          results and should be set to a sufficient value.
+          (<citerefentry>
+               <refentrytitle>sssd-ldap</refentrytitle><manvolnum>5</manvolnum>
+          </citerefentry>) option.
+        </para>
+    </refsect1>
+
     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/seealso.xml" />
 
 </refentry>
-- 
1.9.0



More information about the sssd-devel mailing list