[389-users] Views, Filtered roles and CoS

[Colin Panisset]

That's *exactly* what I need to do, and a solution that works perfectly
for me.

Thanks!

  -- C.

On 1/06/11 1:45 AM, Andrey Ivanov wrote:
> Hi Colin,
> 
> you can use two different attributes (or the subtypes of an attribute).
> But it implies that the nss_ldap configuration file on development
> servers is different. That's the way we do it. Example:
> 
> the user entry :
> dn: uid=test.user,ou=People,dc=example,dc=com
> loginShell: /bin/rbash
> loginShell;devel: /bin/bash
> uid: test.user
> ...
> 
> If you use RedHat/CentOS 5.x the only difference between the nss_ldap
> configuration files (/etc/ldap.conf) will be the mapping part on
> development servers :
> nss_map_attribute loginShell loginShell;devel
> 
> This example uses the attribute subtype ';devel' but you are free to
> choose anything you like.
> 
> It's not a pure ldap solution, but rather a mix of ldap and server-side
> solution. Don't know whether it helps you but that's how we use it (this
> way,the same ldap user may have several "personalized" posix attributes
> depending on the /etc/ldap.conf configuration of the server) :
> nss_map_attribute uidNumber uidNumber;devel
> nss_map_attribute gidNumber gidNumber;devel
> nss_map_attribute homeDirectory homeDirectory;devel
> nss_map_attribute loginShell loginShell;devel
> 
> @+
> 
> 2011/5/31 Colin Panisset <colin.panisset at rea-group.com
> <mailto:colin.panisset at rea-group.com>>
> 
>     I have a pretty flat DIT, with all users currently under
>     ou=people,dc=example,dc=com; these user objects also have posixAccount
>     attributes, of which loginShell is one.
> 
>     What I'm trying to achieve is to be able to set a "default" loginShell
>     to be a restricted shell (/bin/rbash) for developers, but allow that to
>     be a non-restricted shell on systems which are development hosts.
> 
>     As an example, on a production host I'd like:
> 
>     $ ldapsearch -x "(uid=devuser)" uid loginshell
> 
>     to return:
> 
>     dn: cn=Dev User,ou=People,dc=example,dc=com
>     loginShell: /bin/rbash
>     uid: devuser
> 
>     while on a development host, I'd like the same search to return
> 
>     dn: cn=Dev User,ou=People,dc=example,dc=com
>     loginShell: /bin/bash
>     uid: devuser
>