[SSSD] [PATCH] MAN: Clarify usage of groups search base with tokengroups

Lukas Slebodnik lslebodn at redhat.com
Wed Nov 12 14:35:43 UTC 2014


On (11/11/14 16:05), Dan Lavu wrote:
>I think this explains the feature better.
>
>From 0504e88c570f1f5a3957008041940c25555be43a Mon Sep 17 00:00:00 2001
>From: Dan Lavu <dlavu at redhat.com>
>Date: Tue, 11 Nov 2014 15:46:51 -0500
>Subject: [PATCH] Man page edit for ldap_use_tokengroups
> https://fedorahosted.org/sssd/ticket/2448
>
>---
> src/man/sssd-ldap.5.xml | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
>diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
>index 3f7d07a..168002d 100644
>--- a/src/man/sssd-ldap.5.xml
>+++ b/src/man/sssd-ldap.5.xml
>@@ -2454,7 +2454,18 @@ ldap_access_filter = (employeeType=admin)
>                     <term>ldap_group_search_base (string)</term>
>                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
>                 </varlistentry>
>-
>+            </variablelist>
>+            <variablelist>
>+                <note>
>+                    <para>
>+                        If the option <quote>ldap_use_tokengroups</quote> is
>+                        enabled. The searches against Active Directory will
>+                        not be restricted and return all groups memberships,
>+                        even with no gid mapping. It is reccomended to disable
>+                        this feature, if group names are not being displayed
>+                        correctly.
>+                    </para>
>+                </note>
>                 <varlistentry condition="with_sudo">
>                     <term>ldap_sudo_search_base (string)</term>
>                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
>-- 

That's better :-)
I'm just attaching patch with shorter title in commit message.
Ticket URL need't be in title.

LS
-------------- next part --------------
>From 6651792e39fc19bdcbf1f5f3197cb2ccc09d68f6 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu at redhat.com>
Date: Tue, 11 Nov 2014 15:46:51 -0500
Subject: [PATCH] MAN: page edit for ldap_use_tokengroups

Resolves:
https://fedorahosted.org/sssd/ticket/2448
---
 src/man/sssd-ldap.5.xml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index d7a2a4ac9fa2497a4c347a2a7e77703e53b8a46c..5b36f69a679a1362290d8fea1f4c8fc29cc548d8 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -2482,7 +2482,18 @@ ldap_access_filter = (employeeType=admin)
                     <term>ldap_group_search_base (string)</term>
                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
                 </varlistentry>
-
+            </variablelist>
+            <variablelist>
+                <note>
+                    <para>
+                        If the option <quote>ldap_use_tokengroups</quote> is
+                        enabled. The searches against Active Directory will
+                        not be restricted and return all groups memberships,
+                        even with no gid mapping. It is recommended to disable
+                        this feature, if group names are not being displayed
+                        correctly.
+                    </para>
+                </note>
                 <varlistentry condition="with_sudo">
                     <term>ldap_sudo_search_base (string)</term>
                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
-- 
2.1.0



More information about the sssd-devel mailing list