[SSSD] [PATCH] MAN: Clarify usage of groups search base with tokengroups

Lukas Slebodnik lslebodn at redhat.com
Thu Nov 20 10:46:57 UTC 2014


On (19/11/14 23:43), Jakub Hrozek wrote:
>On Thu, Nov 13, 2014 at 07:41:00PM +0100, Jakub Hrozek wrote:
>> On Wed, Nov 12, 2014 at 03:35:43PM +0100, Lukas Slebodnik wrote:
>> > On (11/11/14 16:05), Dan Lavu wrote:
>> > >I think this explains the feature better.
>> > >
>> > >From 0504e88c570f1f5a3957008041940c25555be43a Mon Sep 17 00:00:00 2001
>> > >From: Dan Lavu <dlavu at redhat.com>
>> > >Date: Tue, 11 Nov 2014 15:46:51 -0500
>> > >Subject: [PATCH] Man page edit for ldap_use_tokengroups
>> > > https://fedorahosted.org/sssd/ticket/2448
>> > >
>> > >---
>> > > src/man/sssd-ldap.5.xml | 13 ++++++++++++-
>> > > 1 file changed, 12 insertions(+), 1 deletion(-)
>> > >
>> > >diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
>> > >index 3f7d07a..168002d 100644
>> > >--- a/src/man/sssd-ldap.5.xml
>> > >+++ b/src/man/sssd-ldap.5.xml
>> > >@@ -2454,7 +2454,18 @@ ldap_access_filter = (employeeType=admin)
>> > >                     <term>ldap_group_search_base (string)</term>
>> > >                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
>> > >                 </varlistentry>
>> > >-
>> > >+            </variablelist>
>> > >+            <variablelist>
>> > >+                <note>
>> > >+                    <para>
>> > >+                        If the option <quote>ldap_use_tokengroups</quote> is
>> > >+                        enabled. The searches against Active Directory will
>> > >+                        not be restricted and return all groups memberships,
>> > >+                        even with no gid mapping. It is reccomended to disable
>> > >+                        this feature, if group names are not being displayed
>> > >+                        correctly.
>> > >+                    </para>
>> > >+                </note>
>> > >                 <varlistentry condition="with_sudo">
>> > >                     <term>ldap_sudo_search_base (string)</term>
>> > >                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
>> > >-- 
>> > 
>> > That's better :-)
>> > I'm just attaching patch with shorter title in commit message.
>> > Ticket URL need't be in title.
>> > 
>> > LS
>> 
>> ACK
>
>* master: 02011187307ce97d1f41810288b617682a1f311a
>
>I couldn't apply the patch atop sssd-1-11, can you send a rebased patch?
There was conclict beacause of  commit 9dc153a402a36eeb6edbbf23ef489d957b9a76d0
    "LDAP: Deprecate ldap_{user,group}_search_filter"

Updated version is attached.

LS
-------------- next part --------------
>From 9b9399b4a753af2a15ad41be1241f38d9b963c69 Mon Sep 17 00:00:00 2001
From: Dan Lavu <dlavu at redhat.com>
Date: Tue, 11 Nov 2014 15:46:51 -0500
Subject: [PATCH] MAN: page edit for ldap_use_tokengroups

Resolves:
https://fedorahosted.org/sssd/ticket/2448
---
 src/man/sssd-ldap.5.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 557cafcb223a35f9dd61d9761bea29c75613c6c0..9436a28a0808836efcc71db2f0b4675989174ff3 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -2428,6 +2428,18 @@ ldap_access_filter = (employeeType=admin)
                     <term>ldap_group_search_base (string)</term>
                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
                 </varlistentry>
+            </variablelist>
+            <variablelist>
+                <note>
+                    <para>
+                        If the option <quote>ldap_use_tokengroups</quote> is
+                        enabled. The searches against Active Directory will
+                        not be restricted and return all groups memberships,
+                        even with no gid mapping. It is recommended to disable
+                        this feature, if group names are not being displayed
+                        correctly.
+                    </para>
+                </note>
 
                 <varlistentry>
                     <term>ldap_user_search_filter (string)</term>
-- 
2.1.0



More information about the sssd-devel mailing list