Re: [SSSD-users] filter ldap users or groups
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/13/2014 03:56 PM, George Vasiliu wrote:
Hi,
We're migrating from pam_ldap to sssd and so far everything works
as expected: ldapsearch, getent passwd <user>, getent group
<group>, tested offline caching, great product!
From a security perspective, nslcd ( CentOS 6) is not able to get
any users that are not part of certain allowed groups by having
"filter passwd LDAP_FILTER" in /etc/nslcd.conf. Is there any
similar functionality I could use with SSSD to prevent exposing
whole ldap tree? Do filter_groups or/and filter_users work with
ldap filters?
Take a look at the sssd-ldap(5) manpage[1] and search on
'ldap_search_base'. It has an optional component that allows you to
specify a filter limiting the lookups.
In your specific case, you're probably looking for:
ldap_user_search_base =
ou=users,o=Example,dc=example,dc=com?subtree?(|(description=CN=prod,OU=groups,O=Example,DC=example,DC=com)(description=CN=sec,OU=groups,O=Example,DC=example,DC=com))
[1]
http://jhrozek.fedorapeople.org/sssd/1.11.5.1/man/sssd-ldap.5.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlNyfrAACgkQeiVVYja6o6NVZQCdHF/HObH7yCJ4aE5lzWgBhLdY
FN0An0kTIkzYtqEnxlmA2PyzE1JOPo8j
=Vy7J
-----END PGP SIGNATURE-----