That's *exactly* what I need to do, and a solution that works perfectly for me. Thanks! -- C. On 1/06/11 1:45 AM, Andrey Ivanov wrote: > Hi Colin, > > you can use two different attributes (or the subtypes of an attribute). > But it implies that the nss_ldap configuration file on development > servers is different. That's the way we do it. Example: > > the user entry : > dn: uid=test.user,ou=People,dc=example,dc=com > loginShell: /bin/rbash > loginShell;devel: /bin/bash > uid: test.user > ... > > If you use RedHat/CentOS 5.x the only difference between the nss_ldap > configuration files (/etc/ldap.conf) will be the mapping part on > development servers : > nss_map_attribute loginShell loginShell;devel > > This example uses the attribute subtype ';devel' but you are free to > choose anything you like. > > It's not a pure ldap solution, but rather a mix of ldap and server-side > solution. Don't know whether it helps you but that's how we use it (this > way,the same ldap user may have several "personalized" posix attributes > depending on the /etc/ldap.conf configuration of the server) : > nss_map_attribute uidNumber uidNumber;devel > nss_map_attribute gidNumber gidNumber;devel > nss_map_attribute homeDirectory homeDirectory;devel > nss_map_attribute loginShell loginShell;devel > > @+ > > 2011/5/31 Colin Panisset <colin.panisset@xxxxxxxxxxxxx > <mailto:colin.panisset@xxxxxxxxxxxxx>> > > I have a pretty flat DIT, with all users currently under > ou=people,dc=example,dc=com; these user objects also have posixAccount > attributes, of which loginShell is one. > > What I'm trying to achieve is to be able to set a "default" loginShell > to be a restricted shell (/bin/rbash) for developers, but allow that to > be a non-restricted shell on systems which are development hosts. > > As an example, on a production host I'd like: > > $ ldapsearch -x "(uid=devuser)" uid loginshell > > to return: > > dn: cn=Dev User,ou=People,dc=example,dc=com > loginShell: /bin/rbash > uid: devuser > > while on a development host, I'd like the same search to return > > dn: cn=Dev User,ou=People,dc=example,dc=com > loginShell: /bin/bash > uid: devuser > -- 389 users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/389-users
