[SSSD] Design Discussion: Restricting domains per PAM service

Simo Sorce simo at redhat.com
Mon Sep 29 18:17:27 UTC 2014


On Mon, 29 Sep 2014 15:28:28 +0200
Jan Pazdziora <jpazdziora at redhat.com> wrote:

> On Tue, Sep 23, 2014 at 10:03:36AM -0400, Simo Sorce wrote:
> > 
> > I would defer this to when we have actual requests for it.
> > I am not necessarily opposed but it will be confusing. You see a
> > list of domains (or even 'none') and then you have to (at least
> > mentally) parse all the code snippets to find out who can do what. 
> > 
> > I think domain snippets, in general, should not influence other
> > services behavior, but just define the domain itself.
> 
> Actually, I've been hoping we could move towards making [domain/...]
> and [pam-service/...] and other types not just define what their are,
> but also the behaviour of the rest of the sssd towards that object. It
> feels a bit more natural to say "for this domain, these users can
> consume the identities", than go the other way round.

The problem of doing this is that then users from "other" domains are
kind of out of place, also the admin needs to inspect several snippets
to find out what is the overall security policy, I am not comfortable
with the latter specifically.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list