[SSSD-users] per-domain authorized_service

Jakub Hrozek jhrozek at redhat.com
Tue May 13 07:44:11 UTC 2014

On Mon, May 12, 2014 at 11:34:44PM +0300, Eugene Istomin wrote:
> Hello,
> Is it possible to set constant value for authorized_service in the domain 
> configuration?
> Like :
> [domain/sshd]
> ...
> ldap_access_order = authorized_service
> authorized_services = sshd
> ...
> Thanks!
> ---
> Best regards,
> Eugene Istomin


are you looking for access control based on the PAM service? If so,
we're planning to work on this during the 1.12 cycle (underway now):

The title of the bug is a bit misleading, but scroll down through the
comments to read the full proposal.

Right now, SSSD only supports the access control based on authorized
services in user's LDAP entry, as documented in the sssd-ldap man page:

ldap_user_authorized_service (string)
    If access_provider=ldap and ldap_access_order=authorized_service, SSSD will use the
    presence of the authorizedService attribute in the user's LDAP entry to determine access

    An explicit deny (!svc) is resolved first. Second, SSSD searches for explicit allow (svc)
    and finally for allow_all (*).

    Please note that the ldap_access_order configuration option must include
    “authorized_service” in order for the ldap_user_authorized_service option to work.

    Default: authorizedService

More information about the sssd-users mailing list