[SSSD] [PATCH] MAN: Amend the description of ignore_group_members
Jakub Hrozek
jhrozek at redhat.com
Wed Jan 14 10:13:24 UTC 2015
Hi,
I'm sending this man page amendment on behalf of one of our users who
suggested to improve the description of ignore_group_members.
-------------- next part --------------
>From 6c8cee6aeb6548bfc78d1ba2979a3ba8b002c522 Mon Sep 17 00:00:00 2001
From: John Dickerson <jedicker at iastate.edu>
Date: Fri, 12 Dec 2014 10:38:10 +0100
Subject: [PATCH] MAN: Amend the description of ignore_group_members
The option description should hint that enabling this option may have a
positive effect on access control, especially with large groups.
See https://bugzilla.redhat.com/show_bug.cgi?id=1172338 for an example
where ignoring the group members helped.
---
src/man/sssd.conf.5.xml | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 2002ccc7caf7013ead5b97c463fba46b734090ae..ac45f0a044b578210e13197d6ae0681ff2a24220 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -1487,7 +1487,25 @@ fallback_homedir = /home/%u
If set to TRUE, the group membership attribute
is not requested from the ldap server, and
group members are not returned when processing
- group lookup calls.
+ group lookup calls, such as
+ <citerefentry>
+ <refentrytitle>getgrnam</refentrytitle>
+ <manvolnum>3</manvolnum>
+ </citerefentry>
+ or
+ <citerefentry>
+ <refentrytitle>getgrgid</refentrytitle>
+ <manvolnum>3</manvolnum>
+ </citerefentry>.
+ As an effect, <quote>getent group
+ $groupname</quote> would return the requested
+ group as if it was empty.
+ </para>
+ <para>
+ Enabling this option can also make access
+ provider checks for group membership
+ significantly faster, especially for groups
+ containing many members.
</para>
<para>
Default: FALSE
--
2.1.0
More information about the sssd-devel
mailing list