On Sat, Oct 21, 2017 at 11:30:16PM +0200, Jakub Hrozek wrote:
> On Tue, Oct 10, 2017 at 09:42:16PM +0200, Jakub Hrozek wrote:
> > Hi,
> >
> > I wrote a design page about exposing the functionality that creates the
> > user private groups based on the user entry only:
> >
> > https://pagure.io/fork/jhrozek/SSSD/docs/blob/mpg/f/design_pages/auto_private_groups.rst
> >
> > For your convenience, I'm also copying the design text in the RST format
> > below.
> >
> > Once the design is approved, I'll propose a PR against the sssd/docs
> > repository.
>
> Since there were no comments about the overall design here or in the PR, I
> submitted a docs PR:
> https://pagure.io/SSSD/docs/pull-request/52
It turns out that I totally forgot about trusted domains for direct
integration. Currently they do not work the same way as the joined domain,
so if I select auto_private_groups for the main domain, I get:
$ getent passwd [email protected]
[email protected]:*:10000:10000:puser:/home/puser:/bin/sh
-- OK, both values are the same here. But:
$ getent passwd [email protected]
[email protected]:*:30000:40000:childuser:/home/[email protected]:/bin/bash
-- the user private group is not generated here.
I must have thought that subdomains with direct integration always use
the private groups, but it's only true for ID mapping...
Luckily we haven't released 1.16.1 yet, so I would like to just change
the semantics of the auto_private_groups option to also affect trusted
domains.
If someone wants per-subdomain granularity, I would later prefer to make
the option valid for the subdomain sections, but for the most part, I
suspect that users will want all or nothing.
Unless someone disagrees, I'll send a PR with this change.
_______________________________________________
sssd-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
