[SSSD] RFC: Expose different identity domains to different D-BUS consumers
Jakub Hrozek
jhrozek at redhat.com
Fri May 22 09:26:35 UTC 2015
On Thu, May 21, 2015 at 09:26:28AM -0400, Dmitri Pal wrote:
> On 05/21/2015 06:22 AM, Pavel Březina wrote:
> >https://fedorahosted.org/sssd/ticket/2187
> >
> >My idea is as follows:
> >
> >- create new option 'domains' in [ifp] sections
> >- this option can reduce number of domains set in 'domains' in [sssd]
> >section
> >- provide this reduced domains set to rctx->domains
> >
> >[sssd]
> >domains = A, B, C
> >
> >[ifp]
> >domains = B
> >
> >rctx->domains would contain only B in ifp responder.
> >
> >But I am not sure if it fulfills the requirement.
>
> IMO it should be similar to
> https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM but for
> IFP.
> The design above does not address the requirement.
Yes.
Long-term, we should really consider polkit instead of just using UIDs
in sssd.conf.
More information about the sssd-devel
mailing list