[SSSD] [sssd][pathces] MAN: nested group membership

Stephen Gallagher sgallagh at redhat.com
Mon Jun 2 15:49:59 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon 02 Jun 2014 09:13:32 AM EDT, Jakub Hrozek wrote:
> On Mon, Jun 02, 2014 at 08:22:14AM -0400, Stephen Gallagher wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 06/01/2014 04:09 PM, Jakub Hrozek wrote:
>>> On Fri, May 30, 2014 at 06:04:01PM +0200, Pavel Reichl wrote:
>>>> OK, please see updated patch. PR
>>>
>>> Thank you, from content point of view, this looks correct to me.
>>>
>>> Can you please ping some native English speaker before I push the
>>> patch? There are two parts below that I'm not sure about, but as I
>>> said, it's not about content, just ironing out the language.
>>>
>>> [snip]
>>>
>>>> @@ -1776,7 +1776,14 @@ users being denied access. Use
>>>> access_provider = permit to change this default behavior. Please
>>>> note that this filter is applied on -
>>>> the LDAP user entry only. +                            the LDAP
>>>> user entry only and thus filtering based +
>>>> on nested groups may not work (e.g. memberOf +
>>>> attribute on AD entries points only on direct
>>
>> "points only *to* direct parents"
>>
>>>> +                            parents). If nested group based
>>>> filtering is +                            desired please see
>>>
>>
>> "If filtering based on nested groups is required, please see"
>>
>>
>>> Maybe required instead of desired?
>>>
>>>> +                            <citerefentry> +
>>>> <refentrytitle>sssd-simple</refentrytitle><manvolnum>5</manvolnum>
>>>>
>>>>
>> +                            </citerefentry>.
>>>> </para> <para> Example: diff --git a/src/man/sssd-simple.5.xml
>>>> b/src/man/sssd-simple.5.xml index
>>>> 8f94990da9d94dca2f6b5730aaab6b4468fed487..5a0af337e3a45175aaa7a1a36fae5c1da2ead0c4
>>>> 100644 --- a/src/man/sssd-simple.5.xml +++
>>>> b/src/man/sssd-simple.5.xml @@ -144,6 +144,18 @@ </para>
>>>> </refsect1>
>>>>
>>>> +    <refsect1 id='notes'> +        <title>NOTES</title> +
>>>> <para> +          The complete group memberships are resolved
>>>> before the access check,
>>>
>>> I'm not sure if "group memberships are" should read "group
>>> membership is", iow if it's better to use singular or plural
>>> here..
>>>
>>
>> "The complete group membership hierarchy is resolved before the access
>> check, thus even nested groups..."
>>
>>
>>>> +          so even nested groups can be included in the access
>>>> lists. Please be +          aware of ldap_group_nesting_level
>>
>>
>> "Please be aware that the 'ldap_group_nesting_level' option may impact
>> the results and should be set to a sufficient value."
>
> Thanks for the review!
>
> Pavel is not around today, so I took the liberty of updating the patch
> with your suggestions so we can move forward.
>


Ack
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlOMnScACgkQeiVVYja6o6NUJwCfVaEXxh20MrucQaSHO8fnTgQY
8noAn0zCdoCxsjeAkLVCtQYieEmEXQKI
=FOz9
-----END PGP SIGNATURE-----




More information about the sssd-devel mailing list