path: root/
diff options
authorSumit Bose <>2013-08-19 17:15:47 +0200
committerJakub Hrozek <>2013-08-28 17:30:07 +0200
commitcaee9828ee30609e9f433957dbb3d0163390a207 (patch)
tree323dc74055327b86a47e2e32ffb14a66b25a5971 /
parentb8d0374cd23db90fce203292ff547641f62e338a (diff)
ipa-server-mode: add IPA group memberships to AD users
When IPA trusts an AD domain the AD user or groups can be placed into IPA groups e.g. to put AD users under the control of HBAC. Since IPA group can only have members from the IPA directory tree and the AD users and groups are not stored there a special IPA object called external group was introduced. SIDs of users and groups can be added to the external group and since the external groups are in the IPA directory tree they can be member of IPA groups. To speed things up and to remove some load from the IPA servers SSSD reads all external groups and stores them in memory for some time before rereading the data. Enhances
Diffstat (limited to '')
1 files changed, 1 insertions, 0 deletions
diff --git a/ b/
index c3f3c4a54..3dd81ad07 100644
--- a/
+++ b/
@@ -1565,6 +1565,7 @@ libsss_ipa_la_SOURCES = \
src/providers/ipa/ipa_hosts.c \
src/providers/ipa/ipa_subdomains.c \
src/providers/ipa/ipa_subdomains_id.c \
+ src/providers/ipa/ipa_subdomains_ext_groups.c \
src/providers/ipa/ipa_s2n_exop.c \
src/providers/ipa/ipa_hbac_hosts.c \
src/providers/ipa/ipa_hbac_private.h \