12:47 p.m.
The attached patch addresses:
https://fedorahosted.org/sssd/ticket/2235
The memberof example was misleading and was making aministrators think
that the ldap_access_filter can resolve nested group memberships.
The alternative I was considering was changing the example to use a
different attribute altogether, but I was struggling to come up with an
example that wouldn't be too artificial (like
ldap_access_filter=/bin/bash).
7:41 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/24/2014 01:47 PM, Jakub Hrozek wrote:
The attached patch addresses:
https://fedorahosted.org/sssd/ticket/2235
The memberof example was misleading and was making aministrators
think that the ldap_access_filter can resolve nested group
memberships.
The alternative I was considering was changing the example to use
a different attribute altogether, but I was struggling to come up
with an example that wouldn't be too artificial (like
ldap_access_filter=/bin/bash).
Ack, though I wonder if it wouldn't hurt to come up with a different
example here. Perhaps:
ldap_access_filter = (employeeType=admin)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlMN7yUACgkQeiVVYja6o6MbCgCfVdvK3ztFu6hHEC+lZRqyjAZ0
S/QAnjpO2ragyvzdW2NFGuoKaWgtK7tu
=40KT
-----END PGP SIGNATURE-----
9:08 a.m.
On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
The attached patch addresses:
https://fedorahosted.org/sssd/ticket/2235
The memberof example was misleading and was making aministrators think
that the ldap_access_filter can resolve nested group memberships.
The alternative I was considering was changing the example to use a
different attribute altogether, but I was struggling to come up with an
example that wouldn't be too artificial (like
ldap_access_filter=/bin/bash).
Stephen's review seems to be stuck in mailman queue, so I'm sending a
patch that contains his suggestion as a reply to myself.
The employeeType attribute Stephen suggested is a good choice, I think.
10:14 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
> The attached patch addresses:
> https://fedorahosted.org/sssd/ticket/2235
>
> The memberof example was misleading and was making aministrators
> think that the ldap_access_filter can resolve nested group
> memberships.
>
> The alternative I was considering was changing the example to use
> a different attribute altogether, but I was struggling to come up
> with an example that wouldn't be too artificial (like
> ldap_access_filter=/bin/bash).
Stephen's review seems to be stuck in mailman queue, so I'm sending
a patch that contains his suggestion as a reply to myself.
The employeeType attribute Stephen suggested is a good choice, I
think.
If we're changing the cited example, I'm not sure we need to call out
the memberOf example anymore.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlMOEukACgkQeiVVYja6o6OPEgCdET71XFoS19OAUPlDt/YMjqyV
jiYAoIHSQq0y4tgCpArlHqPY0cMT2Z8K
=TL8d
-----END PGP SIGNATURE-----
10:22 a.m.
On Wed, Feb 26, 2014 at 11:14:33AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
> On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
>> The attached patch addresses:
>> https://fedorahosted.org/sssd/ticket/2235
>>
>> The memberof example was misleading and was making aministrators
>> think that the ldap_access_filter can resolve nested group
>> memberships.
>>
>> The alternative I was considering was changing the example to use
>> a different attribute altogether, but I was struggling to come up
>> with an example that wouldn't be too artificial (like
>> ldap_access_filter=/bin/bash).
>
> Stephen's review seems to be stuck in mailman queue, so I'm sending
> a patch that contains his suggestion as a reply to myself.
>
> The employeeType attribute Stephen suggested is a good choice, I
> think.
>
If we're changing the cited example, I'm not sure we need to call out
the memberOf example anymore.
Hmm, initially I wanted to keep it in, because memberOf is what I see
used mostly in the field but you're right that when I don't think about
the context of the change and just read the man page text, it is
confusing to start talking about memberOf.
Another iteration of the patch is attached.
10:30 a.m.
On Wed, Feb 26, 2014 at 05:22:51PM +0100, Jakub Hrozek wrote:
On Wed, Feb 26, 2014 at 11:14:33AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
> > On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
> >> The attached patch addresses:
> >> https://fedorahosted.org/sssd/ticket/2235
> >>
> >> The memberof example was misleading and was making aministrators
> >> think that the ldap_access_filter can resolve nested group
> >> memberships.
> >>
> >> The alternative I was considering was changing the example to use
> >> a different attribute altogether, but I was struggling to come up
> >> with an example that wouldn't be too artificial (like
> >> ldap_access_filter=/bin/bash).
> >
> > Stephen's review seems to be stuck in mailman queue, so I'm sending
> > a patch that contains his suggestion as a reply to myself.
> >
> > The employeeType attribute Stephen suggested is a good choice, I
> > think.
> >
>
> If we're changing the cited example, I'm not sure we need to call out
> the memberOf example anymore.
Hmm, initially I wanted to keep it in, because memberOf is what I see
used mostly in the field but you're right that when I don't think about
the context of the change and just read the man page text, it is
confusing to start talking about memberOf.
Another iteration of the patch is attached.
Yet another version that retains a part of the paragraph (.."applied on
the LDAP entry only..") and changes description of the example.
10:45 a.m.
On Wed, Feb 26, 2014 at 05:30:55PM +0100, Jakub Hrozek wrote:
On Wed, Feb 26, 2014 at 05:22:51PM +0100, Jakub Hrozek wrote:
> On Wed, Feb 26, 2014 at 11:14:33AM -0500, Stephen Gallagher wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
> > > On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
> > >> The attached patch addresses:
> > >> https://fedorahosted.org/sssd/ticket/2235
> > >>
> > >> The memberof example was misleading and was making aministrators
> > >> think that the ldap_access_filter can resolve nested group
> > >> memberships.
> > >>
> > >> The alternative I was considering was changing the example to use
> > >> a different attribute altogether, but I was struggling to come up
> > >> with an example that wouldn't be too artificial (like
> > >> ldap_access_filter=/bin/bash).
> > >
> > > Stephen's review seems to be stuck in mailman queue, so I'm
sending
> > > a patch that contains his suggestion as a reply to myself.
> > >
> > > The employeeType attribute Stephen suggested is a good choice, I
> > > think.
> > >
> >
> > If we're changing the cited example, I'm not sure we need to call out
> > the memberOf example anymore.
>
> Hmm, initially I wanted to keep it in, because memberOf is what I see
> used mostly in the field but you're right that when I don't think about
> the context of the change and just read the man page text, it is
> confusing to start talking about memberOf.
>
> Another iteration of the patch is attached.
Yet another version that retains a part of the paragraph (.."applied on
the LDAP entry only..") and changes description of the example.
And now with the correct patch..
11:03 a.m.
On Wed, Feb 26, 2014 at 05:45:51PM +0100, Jakub Hrozek wrote:
On Wed, Feb 26, 2014 at 05:30:55PM +0100, Jakub Hrozek wrote:
> On Wed, Feb 26, 2014 at 05:22:51PM +0100, Jakub Hrozek wrote:
> > On Wed, Feb 26, 2014 at 11:14:33AM -0500, Stephen Gallagher wrote:
> > > -----BEGIN PGP SIGNED MESSAGE-----
> > > Hash: SHA1
> > >
> > > On 02/26/2014 10:08 AM, Jakub Hrozek wrote:
> > > > On Mon, Feb 24, 2014 at 07:47:08PM +0100, Jakub Hrozek wrote:
> > > >> The attached patch addresses:
> > > >> https://fedorahosted.org/sssd/ticket/2235
> > > >>
> > > >> The memberof example was misleading and was making aministrators
> > > >> think that the ldap_access_filter can resolve nested group
> > > >> memberships.
> > > >>
> > > >> The alternative I was considering was changing the example to
use
> > > >> a different attribute altogether, but I was struggling to come
up
> > > >> with an example that wouldn't be too artificial (like
> > > >> ldap_access_filter=/bin/bash).
> > > >
> > > > Stephen's review seems to be stuck in mailman queue, so I'm
sending
> > > > a patch that contains his suggestion as a reply to myself.
> > > >
> > > > The employeeType attribute Stephen suggested is a good choice, I
> > > > think.
> > > >
> > >
> > > If we're changing the cited example, I'm not sure we need to call
out
> > > the memberOf example anymore.
> >
> > Hmm, initially I wanted to keep it in, because memberOf is what I see
> > used mostly in the field but you're right that when I don't think
about
> > the context of the change and just read the man page text, it is
> > confusing to start talking about memberOf.
> >
> > Another iteration of the patch is attached.
>
> Yet another version that retains a part of the paragraph (.."applied on
> the LDAP entry only..") and changes description of the example.
And now with the correct patch..
looks good, ACK.
bye,
Sumit
3720
days inactive
3722
days old
sssd-devel@lists.fedorahosted.org
8 comments
3 participants
participants (3)
-
Jakub Hrozek -
Stephen Gallagher -
Sumit Bose