[SSSD-users] filter ldap users or groups

Stephen Gallagher sgallagh at redhat.com
Tue May 13 20:21:04 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/13/2014 03:56 PM, George Vasiliu wrote:
> 
> Hi,
> 
> We're migrating from pam_ldap to sssd and so far everything works
> as expected: ldapsearch, getent passwd <user>, getent group
> <group>, tested offline caching, great product!
> 
> From a security perspective, nslcd ( CentOS 6) is not able to get
> any users that are not part of certain allowed groups by having
> "filter passwd LDAP_FILTER" in /etc/nslcd.conf. Is there any
> similar functionality I could use with SSSD to prevent exposing
> whole ldap tree? Do filter_groups or/and filter_users work with
> ldap filters?
> 

Take a look at the sssd-ldap(5) manpage[1] and search on
'ldap_search_base'. It has an optional component that allows you to
specify a filter limiting the lookups.

In your specific case, you're probably looking for:

ldap_user_search_base =
ou=users,o=Example,dc=example,dc=com?subtree?(|(description=CN=prod,OU=groups,O=Example,DC=example,DC=com)(description=CN=sec,OU=groups,O=Example,DC=example,DC=com))


[1]
http://jhrozek.fedorapeople.org/sssd/1.11.5.1/man/sssd-ldap.5.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlNyfrAACgkQeiVVYja6o6NVZQCdHF/HObH7yCJ4aE5lzWgBhLdY
FN0An0kTIkzYtqEnxlmA2PyzE1JOPo8j
=Vy7J
-----END PGP SIGNATURE-----


More information about the sssd-users mailing list