[SSSD-users] LDAP access provider - list of groups in directory?

Michael Ströder michael at stroeder.com
Thu Jul 10 20:04:13 UTC 2014


Dmitri Pal wrote:
> Have you considered FreeIPA instead of OpenLDAP?
> It has a built in host based access control capability and SSSD naturally
> supports it.

What exactly is this "host based access control capability"?

> With pure LDAP you would have to use ldap access provider and specify a filter
> that matches the DNs you care about. AFAIR OpenLDAP supports 2307bis that
> means that there should be a memberOf attribute on the user entry (or
> something similar). This attribute would be a list of the DNs the user is a
> member of. You can use it in the filter.
> I know that 389-DS supports it for sure.

I've developed a schema and a bunch of set-based OpenLDAP ACLs which authorize
server groups to only see user accounts and groups and sudoers entries linked
to the server group. Every LDAP client has to really authenticate to the LDAP
server though. With this mech the authorization is implemented by whether a
user entry is visible or not on a host.

BTW: I'd really love to see SASL/EXTERNAL being supported with TLS client
certs. Should be fairly simple since using a TLS client cert is already
implemented.

Ciao, Michael.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2398 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140710/82fcd8fb/attachment-0001.p7s>


More information about the sssd-users mailing list