<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hi Sumit, <br></span></div><div><br><span></span></div><div><span> Thanks for your quick reply.</span></div><div><span> </span></div><div><span> In the chapter http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Identity_Management_Guide/migrating-from-nis.html#nis-import-netgroups, The Netgroup migration script sets '--usercat' and '--hostcat' options to IPA netgroups through 'ipa netgroup-mod' command.</span></div><div><br><span></span></div><div><span>More specifically, when IPA imports host based netgroups with triples like (hostA,-,-), (hostB,-,-), The new IPA netgroups are set up with option '--usetcat=all'. Does that means if this IPA netgroup is used in a HBAC rule, then the rule will applied to all users on hostA and hostB. am I right? :)</span></div><div><br><span></span></div><div><span>BTW, do I have to turn on the '--usercat' option for NIS netgroup migration? The HBAC rules are defined inside hosts/hostgroups, and no NIS groups are involved, right? I maybe completely wrong here.</span></div><div><span><br></span></div><div><span>Thanks.</span></div><div><br><span></span></div><div><span>--Gelen<br></span></div><div><br><span></span></div><div><span><br></span></div><div><span> <br></span></div><div><span><br></span></div><div><br></div> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight: bold;">From:</span></b> Sumit Bose <sbose@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> freeipa-users@redhat.com <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, May 15, 2012 1:48 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] Please help: What the purposes of '--usercat' and '--hostcat' options to IPA net groups?<br> </font> </div> <br> On Mon, May 14, 2012 at 07:57:06PM -0700, David Copperfield wrote:<br>> Hi all,<br>> <br>> The online manual says that the '--usercat' means 'User category the rule applies to'; '--hostcat' has the similar explanation. But I still don't understand how that could be used in real life and when/where to use the options.<br>> <br>> Could anyone please shed a light on this? Thanks a lot.<br><br>iirc these options where introduced with the host based access control<br>(HBAC) and are used to identify categories/classes of users and hosts<br>in a more general way than using groups or ip-address ranges. I think<br>currently only the keyword 'all' can be used here, which e.g means that<br>an HBAC rule will match for all users or all hosts. In future it is<br>planned to support other categories, e.g. something like 'local' and<br>'remote' which would catch all users/hosts of the local IPA domain or<br>all users/groups which are coming from remote domains ,respectively.<br><br>HTH<br><br>bye,<br>Sumit<br><br>> <br>> --David<br><br>> _______________________________________________<br>> Freeipa-users mailing list<br>> <a ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br><br>_______________________________________________<br>Freeipa-users mailing list<br><a ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br><br><br> </div> </div> </div></body></html>