[SSSD] [PRELIMINARY][PATCH] ifp users and groups

Pavel Brezina pbrezina at redhat.com
Mon May 4 20:42:45 UTC 2015



----- Original Message -----
> From: "Jakub Hrozek" <jhrozek at redhat.com>
> To: sssd-devel at lists.fedorahosted.org
> Sent: Monday, May 4, 2015 3:25:42 PM
> Subject: Re: [SSSD] [PRELIMINARY][PATCH] ifp users and groups
> 
> On Mon, May 04, 2015 at 02:51:57PM +0200, Pavel Březina wrote:
> > New patches are attached.
> 
> Thanks a lot for the patches!
> 
> > All review-issues should be addressed. Those
> > patches contains also extraAttributes, group members and user attributes
> > acl.
> > 
> > Do we want to implement group attributes acl also?
> 
> For which attributes exactly? I think all information that is reachable
> using the NSS calls can be published by default, but no other
> information should.

Exactly - by default. That means it should be configurable, I guess :-) It is not a problem to introduce 'group_attributes', an analogy to 'user_attributes'. But of course, we don't support any extra attributes for group objects (at least not at the moment).

> 
> > 
> > The groups and users attributes on group object do not reply with full
> > recursive membership at the moment since we do not store in on groups
> > object
> > in sysdb... is it possible to leave it this way or should I compute the
> > membership? Sysdb only contains full user members (in memberuid attribute),
> > but it contains only direct group members (in member attribute).
> > 
> 
> I guess user members are good enough for now. But we should open and
> defer a ticket.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 



More information about the sssd-devel mailing list