On Fri, Sep 13, 2013 at 03:49:25PM +0200, Pavel Březina wrote:
From 2a6573c0ceeaaa51e155a01719bbb283164705cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= pbrezina@redhat.com Date: Fri, 13 Sep 2013 15:48:10 +0200 Subject: [PATCH] man: improve sssd-sudo manual page
Resolves: https://fedorahosted.org/sssd/ticket/2085
src/man/sssd-sudo.5.xml | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/src/man/sssd-sudo.5.xml b/src/man/sssd-sudo.5.xml index 361fdb7b210df280cffce8c9147257bd0b3ecacb..3262eeababe25e6bdae509c91c22cee493f4a2bd 100644 --- a/src/man/sssd-sudo.5.xml +++ b/src/man/sssd-sudo.5.xml @@ -66,11 +66,30 @@ sudoers: files sss <manvolnum>5</manvolnum> </citerefentry>. </para>
<para><emphasis>Note</emphasis>: in order to use netgroups or IPAhostgroups in sudo rules, you also need to correctly set<citerefentry><refentrytitle>nisdomainname</refentrytitle><manvolnum>1</manvolnum></citerefentry>to your domain name.
^^^^^^^ This is ambiguous. Do you mean DNS domain name, IPA domain name...?
</para></refsect1>
<refsect1 id='sssd'> <title>Configuring SSSD to fetch sudo rules</title> <para>
All configuration that is needed on SSSD side is to put "sudo"
What about extend the list of services with "sudo" ?
to <emphasis>services</emphasis> in [sssd] section of<citerefentry><refentrytitle>sssd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. To speed up the LDAP lookups, you can also setsearch base for sudo rules using<emphasis>ldap_sudo_search_base</emphasis> option.</para><para> The following example shows how to configure SSSD to download sudo rules from an LDAP server. </para>@@ -89,8 +108,8 @@ ldap_sudo_search_base = ou=sudoers,dc=example,dc=com
</programlisting> </para> <para> - When the SSSD is configured to use the IPA provider, the sudo - provider is automatically enabled. The sudo search base + When the SSSD is configured to use IPA as the ID provider, + the sudo provider is automatically enabled. The sudo search base is configured to use the compat tree (ou=sudoers,$DC). </para> </refsect1> -- 1.7.11.7
The content looks good, I'd just like to run the patch by some English native speaker.
On 09/16/2013 04:13 PM, Jakub Hrozek wrote:
On Fri, Sep 13, 2013 at 03:49:25PM +0200, Pavel Březina wrote:
From 2a6573c0ceeaaa51e155a01719bbb283164705cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= pbrezina@redhat.com Date: Fri, 13 Sep 2013 15:48:10 +0200 Subject: [PATCH] man: improve sssd-sudo manual page
Resolves: https://fedorahosted.org/sssd/ticket/2085
src/man/sssd-sudo.5.xml | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/src/man/sssd-sudo.5.xml b/src/man/sssd-sudo.5.xml index 361fdb7b210df280cffce8c9147257bd0b3ecacb..3262eeababe25e6bdae509c91c22cee493f4a2bd 100644 --- a/src/man/sssd-sudo.5.xml +++ b/src/man/sssd-sudo.5.xml @@ -66,11 +66,30 @@ sudoers: files sss <manvolnum>5</manvolnum> </citerefentry>. </para>
<para><emphasis>Note</emphasis>: in order to use netgroups or IPAhostgroups in sudo rules, you also need to correctly set<citerefentry><refentrytitle>nisdomainname</refentrytitle><manvolnum>1</manvolnum></citerefentry>to your domain name.^^^^^^^ This is ambiguous. Do you mean DNS domain name, IPA domain name...?
</para> </refsect1> <refsect1 id='sssd'> <title>Configuring SSSD to fetch sudo rules</title> <para>All configuration that is needed on SSSD side is to put "sudo"What about extend the list of services with "sudo" ?
That sounds better, new patch is attached :)
to <emphasis>services</emphasis> in [sssd] section of<citerefentry><refentrytitle>sssd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. To speed up the LDAP lookups, you can also setsearch base for sudo rules using<emphasis>ldap_sudo_search_base</emphasis> option.</para><para> The following example shows how to configure SSSD to download sudo rules from an LDAP server. </para>@@ -89,8 +108,8 @@ ldap_sudo_search_base = ou=sudoers,dc=example,dc=com
</programlisting> </para> <para> - When the SSSD is configured to use the IPA provider, the sudo - provider is automatically enabled. The sudo search base + When the SSSD is configured to use IPA as the ID provider, + the sudo provider is automatically enabled. The sudo search base is configured to use the compat tree (ou=sudoers,$DC). </para> </refsect1> -- 1.7.11.7
The content looks good, I'd just like to run the patch by some English native speaker.
On Tue, Sep 17, 2013 at 02:00:11PM +0200, Pavel Březina wrote:
<emphasis>Note</emphasis>: in order to use netgroups or IPAhostgroups in sudo rules, you also need to correctly set<citerefentry><refentrytitle>nisdomainname</refentrytitle><manvolnum>1</manvolnum></citerefentry>to your domain name.
Can we clarify if this domain name is IPA domain name or client's DNS domain name?
On 09/17/2013 03:39 PM, Jakub Hrozek wrote:
On Tue, Sep 17, 2013 at 02:00:11PM +0200, Pavel Březina wrote:
<emphasis>Note</emphasis>: in order to use netgroups or IPAhostgroups in sudo rules, you also need to correctly set<citerefentry><refentrytitle>nisdomainname</refentrytitle><manvolnum>1</manvolnum></citerefentry>to your domain name.Can we clarify if this domain name is IPA domain name or client's DNS domain name?
Something like this?
I'd prefer to avoid using DNS domain name, since NIS domain doesn't have to necessarily correspond to DNS.
On Fri, Sep 20, 2013 at 11:45:38AM +0200, Pavel Březina wrote:
On 09/17/2013 03:39 PM, Jakub Hrozek wrote:
On Tue, Sep 17, 2013 at 02:00:11PM +0200, Pavel Březina wrote:
<emphasis>Note</emphasis>: in order to use netgroups or IPAhostgroups in sudo rules, you also need to correctly set<citerefentry><refentrytitle>nisdomainname</refentrytitle><manvolnum>1</manvolnum></citerefentry>to your domain name.Can we clarify if this domain name is IPA domain name or client's DNS domain name?
Something like this?
I'd prefer to avoid using DNS domain name, since NIS domain doesn't have to necessarily correspond to DNS.
That's fine by me. ACK.
On Fri, Sep 20, 2013 at 01:21:33PM +0200, Jakub Hrozek wrote:
On Fri, Sep 20, 2013 at 11:45:38AM +0200, Pavel Březina wrote:
On 09/17/2013 03:39 PM, Jakub Hrozek wrote:
On Tue, Sep 17, 2013 at 02:00:11PM +0200, Pavel Březina wrote:
<emphasis>Note</emphasis>: in order to use netgroups or IPAhostgroups in sudo rules, you also need to correctly set<citerefentry><refentrytitle>nisdomainname</refentrytitle><manvolnum>1</manvolnum></citerefentry>to your domain name.Can we clarify if this domain name is IPA domain name or client's DNS domain name?
Something like this?
I'd prefer to avoid using DNS domain name, since NIS domain doesn't have to necessarily correspond to DNS.
That's fine by me. ACK.
Pushed to master and sssd-1-11
sssd-devel@lists.fedorahosted.org
-
Jakub Hrozek -
Pavel Březina