On Tue, Jul 14, 2015 at 11:06:20AM +0300, Alexander Bokovoy wrote:
> On Tue, 14 Jul 2015, Jan Pazdziora wrote:
> >
> >Would it make sense to have a way of running the SSSD evaluation from
> >the WebUI and showing the results there? Clearly distinguished from
> >the LDAP data, yet exposed in the WebUI ...
> Definitely not here. We have checks for HBAC rules with AD users that
> explicitly take external group membership into account already.
> 
> Resolving AD group membership is time-consuming operation and adding it
> into a normal path is going to slow down everything.

Sure. So how about separate tab, which could also ask for confirmation
if the user wants to run the enumeration?

-- 
Jan Pazdziora
Senior Principal Software Engineer, Identity Management Engineering, Red Hat

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to