[Fedora-directory-users] WindowSync and Netgroups: Where to add netgroup attributes?

[Kenneth Holter]

Hi.


We're planning on using netgroups to control user access to the different
servers within our organization, and the netgroups will be populated based
on group memberships on the AD-side (we'll use WindowsSync to sync groups
from AD to DS). The basic idea is this:

   - Sync AD-group entry "group1" over to DS-group entry "group1".
This is
   done automatically with WindowsSync.
   - Populate netgroup entry "netgroup1" based on DS-group entry
"group1".
   Alternately, add "netGroup" object class to DS-group entry.
   - Configure clients to use netgroup based authentication.

A script will be created to manage netgroup membership dynamically, but
creation of netgroups will probably be done manually.

Anyway, we need to decide on whether to have a separate netgroup entry and
populate netgroup attributes here, or if we should simply add
netgroup attributes to the DS-group itself. I believe that both options will
work just fine, but would like to hear from others who may have implemented
a similar scheme. Maybe there are some pitfalls that we should be aware of.


Regards,
Kenneth Holter