[SSSD-users] Merging local/ldap groups

Jakub Hrozek jhrozek at redhat.com
Fri Aug 8 18:16:45 UTC 2014


On Fri, Aug 08, 2014 at 10:45:09AM -0700, Jacob Weber wrote:
> Is it possible to merge a group that's defined locally with one defined on an LDAP server?
> 
> I'm running a Subversion server. I need certain local users like apache to have write access to the repository files. But I also need my LDAP users to be able to write to them.
> 
> I was thinking of creating a local group in /etc/group, containing the local users. Then I'd create a group on the LDAP server with the same name and numeric ID, containing the LDAP users. The repository files would then be assigned to that group, so they're writable by both sets of users. Is that a bad idea?
> 
> Thanks,
> Jacob

Hi,

if you're using the RFC2307 schema (and not RFC2307bis) then it's
possible to just include a local user in the memberUid attribute. See:
    https://fedorahosted.org/sssd/ticket/1020

And:
    https://fedorahosted.org/sssd/wiki/DesignDocs/LocalGroupMembersForRFC2307


More information about the sssd-users mailing list