[SSSD] RFC: Expose different identity domains to different D-BUS consumers

Jakub Hrozek jhrozek at redhat.com
Fri May 22 09:26:35 UTC 2015


On Thu, May 21, 2015 at 09:26:28AM -0400, Dmitri Pal wrote:
> On 05/21/2015 06:22 AM, Pavel Březina wrote:
> >https://fedorahosted.org/sssd/ticket/2187
> >
> >My idea is as follows:
> >
> >- create new option 'domains' in [ifp] sections
> >- this option can reduce number of domains set in 'domains' in [sssd]
> >section
> >- provide this reduced domains set to rctx->domains
> >
> >[sssd]
> >domains = A, B, C
> >
> >[ifp]
> >domains = B
> >
> >rctx->domains would contain only B in ifp responder.
> >
> >But I am not sure if it fulfills the requirement.
> 
> IMO it should be similar to
> https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM but for
> IFP.
> The design above does not address the requirement.

Yes.

Long-term, we should really consider polkit instead of just using UIDs
in sssd.conf.



More information about the sssd-devel mailing list