diff options
| author | Jakub Hrozek <jhrozek@redhat.com> | 2014-02-24 19:42:23 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2014-02-26 18:38:44 +0100 |
| commit | af16267fc9d681fc4230fa82a9fe86de9491c8fd (patch) | |
| tree | 0efdbd4883eba42341b87a4bb4d0fdef689f3367 | |
| parent | cb5090d6da0e0b378b095b151af70fa21cd62e9e (diff) | |
| download | sssd-af16267fc9d681fc4230fa82a9fe86de9491c8fd.tar.gz sssd-af16267fc9d681fc4230fa82a9fe86de9491c8fd.tar.xz sssd-af16267fc9d681fc4230fa82a9fe86de9491c8fd.zip | |
MAN: Clarify the ldap_access_filter option further
https://fedorahosted.org/sssd/ticket/2235
The memberof example was misleading and was making aministrators think
that the ldap_access_filter can resolve nested group memberships.
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
(cherry picked from commit 604d46e028ab62f83060fb88bdd3319a31aca2d1)
| -rw-r--r-- | src/man/sssd-ldap.5.xml | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index cc58544c3..b271a2b7f 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -1775,19 +1775,20 @@ and this option is not set, it will result in all users being denied access. Use access_provider = permit to change this default - behavior. + behavior. Please note that this filter is applied on + the LDAP user entry only. </para> <para> Example: </para> <programlisting> access_provider = ldap -ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com +ldap_access_filter = (employeeType=admin) </programlisting> <para> This example means that access to this host is - restricted to members of the "allowedusers" group - in ldap. + restricted to users whose employeeType + attribute is set to "admin". </para> <para> Offline caching for this feature is limited to |