From 2a2f642aae37e3f41cbbda162a74c2b946a4521f Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Mon, 20 Dec 2010 16:05:14 -0500
Subject: Add authorizedService support

https://fedorahosted.org/sssd/ticket/670
---
 src/man/sssd-ldap.5.xml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

(limited to 'src/man')

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 3406dc469..7a7334622 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -523,6 +523,27 @@
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>ldap_user_authorized_service (string)</term>
+                    <listitem>
+                        <para>
+                            If access_provider=ldap and
+                            ldap_access_order=authorized_service, SSSD will
+                            use the presence of the authorizedService
+                            attribute in the user's LDAP entry to determine
+                            access privilege.
+                        </para>
+                        <para>
+                            An explicit deny (!svc) is resolved first. Second,
+                            SSSD searches for explicit allow (svc) and finally
+                            for allow_all (*).
+                        </para>
+                        <para>
+                            Default: authorizedService
+                        </para>
+                    </listitem>
+                </varlistentry>
+
                 <varlistentry>
                     <term>ldap_group_object_class (string)</term>
                     <listitem>
@@ -1108,6 +1129,11 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                             <emphasis>expire</emphasis>: use
                             ldap_account_expire_policy
                         </para>
+                        <para>
+                            <emphasis>authorized_service</emphasis>: use
+                            the authorizedService attribute to determine
+                            access
+                        </para>
                         <para>
                             Default: filter
                         </para>
-- 
cgit