On 05/31/2011 09:45 AM, Andrey Ivanov wrote:
Hi Colin,
you can use two different attributes (or the subtypes of an
attribute). But it implies that the nss_ldap configuration file on
development servers is different. That's the way we do it.
Example:
the user entry :
dn: uid=test.user,ou=People,dc=example,dc=com
loginShell: /bin/rbash
loginShell;devel: /bin/bash
uid: test.user
...
If you use RedHat/CentOS 5.x the only difference between the
nss_ldap configuration files (/etc/ldap.conf) will be the
mapping part on development servers :
nss_map_attribute loginShell loginShell;devel
This example uses the attribute subtype ';devel' but you are
free to choose anything you like.
It's not a pure ldap solution, but rather a mix of ldap and
server-side solution. Don't know whether it helps you but that's
how we use it (this way,the same ldap user may have several
"personalized" posix attributes depending on the /etc/ldap.conf
configuration of the server) :
nss_map_attribute uidNumber uidNumber;devel
nss_map_attribute gidNumber gidNumber;devel
nss_map_attribute homeDirectory homeDirectory;devel
nss_map_attribute loginShell loginShell;devel
@+
I've added a howto for this -
http://directory.fedoraproject.org/wiki/Howto:HostBasedAttributes
2011/5/31 Colin Panisset <colin.panisset@xxxxxxxxxxxxx>
I have a pretty flat DIT, with all users currently under
ou=people,dc=example,dc=com; these user objects also have
posixAccount
attributes, of which loginShell is one.
What I'm trying to achieve is to be able to set a "default"
loginShell
to be a restricted shell (/bin/rbash) for developers, but
allow that to
be a non-restricted shell on systems which are development
hosts.
As an example, on a production host I'd like:
$ ldapsearch -x "(uid=devuser)" uid loginshell
to return:
dn: cn=Dev User,ou=People,dc=example,dc=com
loginShell: /bin/rbash
uid: devuser
while on a development host, I'd like the same search to
return
dn: cn=Dev User,ou=People,dc=example,dc=com
loginShell: /bin/bash
uid: devuser
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
|
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
