[Freeipa-users] RFE - groups of services

[Lukáš Bezdička]

We came to situation when we need to add parameter memberOf to services,
but there is no configuration in 389 for this nor UI in freeipa. Is it
possible to implement groups for services?

Example of usecase:
We have web service infront of which we put apache with kerberos
authentication and ldap authorization. This service is used by both users
and services/scripts running on nodes. For this we setup service keytabs
per service as we want them unprivileged and we don't want those services
to touch host's principal. This works pretty well so far but management of
the ldap authorization
makes it pain in the ass :( In ideal usecase we'd love to see groups which
can contain services or users or hosts.

Thank you,
Lukas Bezdicka
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20131001/7662e304/attachment.htm>