IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Document use of external group membership

Browse Source
This commit is contained in:
Alexander Bokovoy
2012-09-20 14:31:01 +03:00
committed by Martin Kosek
parent 21ecf2f287
commit 26baae1fe9
1 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
ipalib/plugins/group.py
View File

@@ -76,6 +76,35 @@ EXAMPLES:
Display information about a named group.
ipa group-show localadmins
External group membership is designed to allow users from trusted domains
to be mapped to local POSIX groups in order to actually use IPA resources.
External members should be added to groups that specifically created as
external and non-POSIX. Such group later should be included into one of POSIX
groups.
An external group member is currently a Security Identifier as defined by
the trusted domain.
Example:
1. Make note of the trusted domain security identifier
domainsid = `ipa trust-show <ad.domain> | grep Identifier | cut -d: -f2`
2. Create group for the trusted domain admins' mapping and their local POSIX group:
ipa group-add --desc='<ad.domain> admins external map' ad_admins_external --external
ipa group-add --desc='<ad.domain> admins' ad_admins
3. Add security identifier of Domain Admins of the <ad.domain> to the ad_admins_external
group (security identifier of <ad.domain SID>-513 is Domain Admins group):
ipa group-add-member ad_admins_external --external ${domainsid}-513
4. Allow members of ad_admins_external group to be associated with ad_admins POSIX group:
ipa group-add-member ad_admins --groups ad_admins_external
""")
protected_group_name = u'admins'