On Tue, Jul 14, 2015 at 11:06:20AM +0300, Alexander Bokovoy wrote:
> On Tue, 14 Jul 2015, Jan Pazdziora wrote:
> >Would it make sense to have a way of running the SSSD evaluation from
> >the WebUI and showing the results there? Clearly distinguished from
> >the LDAP data, yet exposed in the WebUI ...
> Definitely not here. We have checks for HBAC rules with AD users that
> explicitly take external group membership into account already.
> Resolving AD group membership is time-consuming operation and adding it
> into a normal path is going to slow down everything.
Sure. So how about separate tab, which could also ask for confirmation
if the user wants to run the enumeration?
Senior Principal Software Engineer, Identity Management Engineering, Red Hat
Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project