[SSSD] Here is a patch for sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout'

Dan Lavu side_control at runlevelone.net
Thu Oct 9 15:58:22 UTC 2014


Jakub, 

It's fine, I just noticed something else that needs to change too. So here's an update and the parameter cases squashed. I'll make sure I can compile the build next time before committing. 

>From 08e0255977e008807a0ff2b34bf10ca5c61ee89f Mon Sep 17 00:00:00 2001 
From: Dan Lavu <dlavu at redhat.com> 
Date: Thu, 9 Oct 2014 08:56:35 -0400 
Subject: [PATCH] Updated the sssd-ldap man page. 

To address https://fedorahosted.org/sssd/ticket/2451 , 
added a note to the section and a full configuration 
example at the bottom of the man page. 
--- 
src/man/sssd-ldap.5.xml | 24 +++++++++++++++++++++++- 
1 file changed, 23 insertions(+), 1 deletion(-) 

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml 
index 03ea7948b69ed28945fc614eee5c47195cd85937..32c4cf86b71c8e75d1d754f870f44239fc24cd2d 100644 
--- a/src/man/sssd-ldap.5.xml 
+++ b/src/man/sssd-ldap.5.xml 
@@ -1941,7 +1941,8 @@ ldap_access_filter = (employeeType=admin) 
</para> 
<para> 
Please note that it is a configuration error if a 
- value is used more than once. 
+ value is used more than once or 'access_provider = ldap' 
+ is not used. 
</para> 
</listitem> 
</varlistentry> 
@@ -2491,6 +2492,27 @@ ldap_access_filter = (employeeType=admin) 
</programlisting> 
</para> 
</refsect1> 
+ <refsect1 id='ldap_access_filter_example'> 
+ <title>LDAP ACCESS FILTER EXAMPLE</title> 
+ <para> 
+ The following example assumes that SSSD is correctly 
+ configured and to use the ldap_access_order=lockout. 
+ </para> 
+ <para> 
+<programlisting> 
+ [domain/LDAP] 
+ id_provider = ldap 
+ auth_provider = ldap 
+ access_provider = ldap 
+ ldap_access_order = lockout 
+ ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=mydomain,dc=org 
+ ldap_uri = ldap://ldap.mydomain.org 
+ ldap_search_base = dc=mydomain,dc=org 
+ ldap_tls_reqcert = demand 
+ cache_credentials = true 
+</programlisting> 
+ </para> 
+ </refsect1> 

<refsect1 id='notes'> 
<title>NOTES</title> 
-- 
1.9.3 


----- Original Message -----

From: "Jakub Hrozek" <jhrozek at redhat.com> 
To: sssd-devel at lists.fedorahosted.org 
Sent: Thursday, October 9, 2014 11:29:03 AM 
Subject: Re: [SSSD] Here is a patch for sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout' 

On Thu, Oct 09, 2014 at 09:38:54AM -0400, Dan Lavu wrote: 
> https://fedorahosted.org/sssd/ticket/2451 
> 
> Added a line in the notes and a full example at the bottom. 

> From 7678b7919e8f06176082d506885b8f85c4120c93 Mon Sep 17 00:00:00 2001 
> From: Dan Lavu <dlavu at redhat.com> 
> Date: Thu, 9 Oct 2014 08:56:35 -0400 
> Subject: [PATCH] Updated the sssd-ldap man page. 
> 
> To address https://fedorahosted.org/sssd/ticket/2451 , 
> added a note to the section and a full configuration 
> example at the bottom of the man page. 
> --- 
> src/man/sssd-ldap.5.xml | 24 +++++++++++++++++++++++- 
> 1 file changed, 23 insertions(+), 1 deletion(-) 
> 
> diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml 
> index 03ea7948b69ed28945fc614eee5c47195cd85937..15902aa9fd94c21d01db7fbce5699b6afb761be5 100644 
> --- a/src/man/sssd-ldap.5.xml 
> +++ b/src/man/sssd-ldap.5.xml 
> @@ -1941,7 +1941,8 @@ ldap_access_filter = (employeeType=admin) 
> </para> 
> <para> 
> Please note that it is a configuration error if a 
> - value is used more than once. 
> + value is used more than once or 'access_provider = ldap' 
> + is not used. 
> </para> 
> </listitem> 
> </varlistentry> 
> @@ -2491,6 +2492,27 @@ ldap_access_filter = (employeeType=admin) 
> </programlisting> 
> </para> 
> </refsect1> 
> + <refsect1 id='ldap_access_filter example'> 

I don't think you can use a space in the id element. With this patch, I 
get a build error: 
/home/remote/jhrozek/devel/sssd/src/man/sssd-ldap.5.xml:2495: element 
refsect1: validity error : Syntax of value for attribute id of refsect1 
is not valid 

> + <title>LDAP ACCESS FILTER EXAMPLE</title> 
> + <para> 
> + The following example assumes that SSSD is correctly 
> + configured and to use the ldap_access_order=lockout. 
> + </para> 
> + <para> 
> +<programlisting> 
> + [domain/LDAP] 
> + id_provider = ldap 
> + auth_provider = ldap 
> + access_provider = ldap 
> + ldap_Access_order = lockout 

A really minor issue, but I'd prefer if all parameters were lowercase. 
OK if I squash in this single change and push? 

> + ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=example,dc=com 
> + ldap_uri = ldap://ldap.mydomain.org 
> + ldap_search_base = dc=mydomain,dc=org 
> + ldap_tls_reqcert = demand 
> + cache_credentials = true 
> +</programlisting> 
> + </para> 
> + </refsect1> 
> 
> <refsect1 id='notes'> 
> <title>NOTES</title> 
> -- 
> 1.9.3 
> 

> _______________________________________________ 
> sssd-devel mailing list 
> sssd-devel at lists.fedorahosted.org 
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel 

_______________________________________________ 
sssd-devel mailing list 
sssd-devel at lists.fedorahosted.org 
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20141009/1f3df28d/attachment.html>


More information about the sssd-devel mailing list