<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 10/01/2013 04:08 AM, Lukáš Bezdička wrote:
<blockquote
cite="mid:CAEePdh=q+FYO-hjvaHP_zQSDaQ6bQ+ojqT_DnOUhJTfD=VJOOA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>We came to situation when we need to add parameter
memberOf to services, but there is no configuration in
389 for this nor UI in freeipa. Is it possible to
implement groups for services?<br>
<br>
</div>
Example of usecase:<br>
</div>
We have web service infront of which we put apache with
kerberos authentication and ldap authorization. This service
is used by both users and services/scripts running on nodes.
For this we setup service keytabs per service as we want
them unprivileged and we don't want those services to touch
host's principal. This works pretty well so far but
management of the ldap authorization <br>
makes it pain in the ass :(</div>
</div>
</div>
</blockquote>
<br>
1) Please explain what this means. What kind of access control you
are talking about? In your application? You are looking to have
something like HBAC library but for services that can be reused by
applications?<br>
2) Please answer above and file an RFE<br>
3) The RFE would most likely get into a pile and sit there for
couple years as we have other things that seem more pressing so
contributing the code for something like this would be a good
option. We can help and guide. Are you interested? <br>
<br>
Thanks<br>
Dmitri<br>
<br>
<blockquote
cite="mid:CAEePdh=q+FYO-hjvaHP_zQSDaQ6bQ+ojqT_DnOUhJTfD=VJOOA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div> In ideal usecase we'd love to see groups which can
contain services or users or hosts.<br>
<br>
</div>
Thank you,<br>
</div>
Lukas Bezdicka<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
x
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>