[SSSD] [PATCH] MAN: Clarify usage of groups search base with tokengroups

Jakub Hrozek jhrozek at redhat.com
Thu Nov 20 17:41:31 UTC 2014


On Thu, Nov 20, 2014 at 01:55:48PM +0100, Jakub Hrozek wrote:
> On Thu, Nov 20, 2014 at 11:46:57AM +0100, Lukas Slebodnik wrote:
> > On (19/11/14 23:43), Jakub Hrozek wrote:
> > >On Thu, Nov 13, 2014 at 07:41:00PM +0100, Jakub Hrozek wrote:
> > >> On Wed, Nov 12, 2014 at 03:35:43PM +0100, Lukas Slebodnik wrote:
> > >> > On (11/11/14 16:05), Dan Lavu wrote:
> > >> > >I think this explains the feature better.
> > >> > >
> > >> > >From 0504e88c570f1f5a3957008041940c25555be43a Mon Sep 17 00:00:00 2001
> > >> > >From: Dan Lavu <dlavu at redhat.com>
> > >> > >Date: Tue, 11 Nov 2014 15:46:51 -0500
> > >> > >Subject: [PATCH] Man page edit for ldap_use_tokengroups
> > >> > > https://fedorahosted.org/sssd/ticket/2448
> > >> > >
> > >> > >---
> > >> > > src/man/sssd-ldap.5.xml | 13 ++++++++++++-
> > >> > > 1 file changed, 12 insertions(+), 1 deletion(-)
> > >> > >
> > >> > >diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
> > >> > >index 3f7d07a..168002d 100644
> > >> > >--- a/src/man/sssd-ldap.5.xml
> > >> > >+++ b/src/man/sssd-ldap.5.xml
> > >> > >@@ -2454,7 +2454,18 @@ ldap_access_filter = (employeeType=admin)
> > >> > >                     <term>ldap_group_search_base (string)</term>
> > >> > >                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
> > >> > >                 </varlistentry>
> > >> > >-
> > >> > >+            </variablelist>
> > >> > >+            <variablelist>
> > >> > >+                <note>
> > >> > >+                    <para>
> > >> > >+                        If the option <quote>ldap_use_tokengroups</quote> is
> > >> > >+                        enabled. The searches against Active Directory will
> > >> > >+                        not be restricted and return all groups memberships,
> > >> > >+                        even with no gid mapping. It is reccomended to disable
> > >> > >+                        this feature, if group names are not being displayed
> > >> > >+                        correctly.
> > >> > >+                    </para>
> > >> > >+                </note>
> > >> > >                 <varlistentry condition="with_sudo">
> > >> > >                     <term>ldap_sudo_search_base (string)</term>
> > >> > >                     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/ldap_search_bases.xml" />
> > >> > >-- 
> > >> > 
> > >> > That's better :-)
> > >> > I'm just attaching patch with shorter title in commit message.
> > >> > Ticket URL need't be in title.
> > >> > 
> > >> > LS
> > >> 
> > >> ACK
> > >
> > >* master: 02011187307ce97d1f41810288b617682a1f311a
> > >
> > >I couldn't apply the patch atop sssd-1-11, can you send a rebased patch?
> > There was conclict beacause of  commit 9dc153a402a36eeb6edbbf23ef489d957b9a76d0
> >     "LDAP: Deprecate ldap_{user,group}_search_filter"
> > 
> > Updated version is attached.
> > 
> > LS
> 
> ACK for sssd-1-11

* sssd-1-11: 3cc9377bfce8bfda69244f7d79ce0062c60faa65



More information about the sssd-devel mailing list