[SSSD-users] how do I restrict access when access_provider = ad ?

Doug Clow doug.clow at dashbox.com
Mon Sep 16 17:34:58 UTC 2013


Hi Jakub,

I would definitely use that ad_access_filter feature.  In fact that is how I expected it was going to work and tried it out originally.  It would also be cool if there was a way to specify users and groups that did not require the whole distinguished name.  A ldap-simple mode if you will.  I know there are technical issues that make this hard to work for group membership.  But, that way sssd could authenticate a user or group regardless if it had been moved to another OU.  Maybe by using "pre-Windows 2000" name or SID.  It would be more Windows like behavior.

I'm happy to do some testing.  Our environment here is CentOS 6.4

Regards,
Doug




On Sep 13, 2013, at 6:04 AM, Jakub Hrozek <jhrozek at redhat.com> wrote:

> On Mon, Sep 09, 2013 at 09:57:35AM -0700, Doug Clow wrote:
>> Thank you Jakub,
>> 
>> Those settings you gave me to minimally add back the ldap access_provider worked perfectly.  All is working well again!
>> 
>> Best,
>> Doug
>> 
>> 
> 
> Hi Doug,
> 
> I'm glad the access control is working for you now. We were thinking
> about means to improve the configuration and here is a first version of
> the design of proposed access control mechanism:
> https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryAccessControl
> 
> If you have any comments, please let us know. In particular, as an
> admin, would you find the extended filter useful?



More information about the sssd-users mailing list