On Fri, 23 Jul 2010 17:17:11 -0400
Scott Duckworth <sduc...@clemson.edu> wrote:

> I've learned that this attribute does exist in our tree, but it's not
> being populated when we add users to groups since our proxy user does
> not have rights to write groupMembership to users.  I'm trying to
> find out if we can get our hands on native eDirectory tools that keep
> groupMembership of posixAccount and member of posixGroup in sync.
> Still, if groupOf/groupMembership is not required by rfc2307bis, it
> would be nice if SSSD did not require it.

Yes, we should handle this gracefully, at least through an option.

> If a user has a groupOf/groupMembership attribute pointing to a group
> outside of ldap_group_search_base, will this be handled gracefully?

Yes, the entry will simply be ignored if not resolvable.


Simo Sorce * Red Hat, Inc * New York

Freeipa-users mailing list

Reply via email to