I am running FDS 1.0.1 and am syncing with AD on Win2003. All is well.
I have a question about the way that 2 sync agreements would work. We
are syncing the People OU, but our groups are in a sibling OU in AD, and
are not synced. If I setup a second agreement for the groups, with the
group membership be synchronized correctly? I guesss I am asking if the
group membership needs to be synced using the same agreement that syncs
Spring Arbor University
I had a similar question a few weeks ago. I wanted to be able to assign
a list of users access to only a specific number of computers. This is
the response I got from Gary Tay:
FDS is very similar to SUN ONE DS5.2, I think netgroup (+@netgroupXXX in
/etc/passwd and /etc/shadow and "compat" keyword in /etc/nsswitch.conf)
LDAP maps could be setup to achieve what you want, it has been used by
many DS5.2 administrators
Step 5Y: Configure "netgroup" to work with RedHat or Solaris Native LDAP
(i.e. controlling user access to host using netgroup LDAP maps)
Configuring LDAP netgroups
[mailto:firstname.lastname@example.org] On Behalf Of Michael
Sent: Tuesday, January 03, 2006 1:35 PM
To: General discussion list for the Fedora Directory server project.
Subject: Re: [Fedora-directory-users] Server-Side ACLs for pam_ldap
Thanks for the response. I'll read up on this, and see if I can get
On Tue, 2006-01-03 at 11:29 -0700, Richard Megginson wrote:
> Michael Montgomery wrote:
> >I do agree that this is closer to what I'm looking for, but the first
> >problem I see is that I wanted to allow Groups of people to login to
> >Groups of servers like:
> >cn=www,ou=Group,dc=example,dc=com is a group of www servers.
> >cn=Unix,ou=Group,dc=example,dc=com is a group of Unix users.
> >So basically, on the people in the Unix group, can login to the www
> >servers, and so forth.
> Right. The host attribute is per user. You could set up a Roles for
> your users, and use Class of Service to automatically add the host
> attribute to the role members.
Fedora-directory-users mailing list