[SSSD] Design Discussion: Restricting domains per PAM service

Jan Pazdziora jpazdziora at redhat.com
Mon Sep 29 13:28:28 UTC 2014


On Tue, Sep 23, 2014 at 10:03:36AM -0400, Simo Sorce wrote:
> 
> I would defer this to when we have actual requests for it.
> I am not necessarily opposed but it will be confusing. You see a list
> of domains (or even 'none') and then you have to (at least
> mentally) parse all the code snippets to find out who can do what. 
> 
> I think domain snippets, in general, should not influence other
> services behavior, but just define the domain itself.

Actually, I've been hoping we could move towards making [domain/...]
and [pam-service/...] and other types not just define what their are,
but also the behaviour of the rest of the sssd towards that object. It
feels a bit more natural to say "for this domain, these users can
consume the identities", than go the other way round.

-- 
Jan Pazdziora
Principal Software Engineer, Identity Management Engineering, Red Hat



More information about the sssd-devel mailing list