[SSSD] Design Discussion: Restricting domains per PAM service
Jan Pazdziora
jpazdziora at redhat.com
Mon Sep 29 13:28:28 UTC 2014
On Tue, Sep 23, 2014 at 10:03:36AM -0400, Simo Sorce wrote:
>
> I would defer this to when we have actual requests for it.
> I am not necessarily opposed but it will be confusing. You see a list
> of domains (or even 'none') and then you have to (at least
> mentally) parse all the code snippets to find out who can do what.
>
> I think domain snippets, in general, should not influence other
> services behavior, but just define the domain itself.
Actually, I've been hoping we could move towards making [domain/...]
and [pam-service/...] and other types not just define what their are,
but also the behaviour of the rest of the sssd towards that object. It
feels a bit more natural to say "for this domain, these users can
consume the identities", than go the other way round.
--
Jan Pazdziora
Principal Software Engineer, Identity Management Engineering, Red Hat
More information about the sssd-devel
mailing list