Bug 1030421

Summary:	man: document that the default access provider in AD provider is "permit"
Product:	Red Hat Enterprise Linux 7	Reporter:	Jakub Hrozek <jhrozek>
Component:	sssd	Assignee:	Jakub Hrozek <jhrozek>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Kaushik Banerjee <kbanerje>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	apeetham, grajaiya, jgalipea, lslebodn, mkosek, pbrezina
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	sssd-1.11.2-4.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 10:28:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Jakub Hrozek 2013-11-14 12:18:45 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/1965

This came up on sssd-users:

The default access_provider [for the AD provider] is "permit" because basically all of the real access providers require configuration to be useful and otherwise default to blocking everyone. Essentially, we elected to behave like FreeIPA with the ALLOW_ALL HBAC rule for initial setup.

This should be spelled out in the man page.

Comment 2 Amith 2014-01-07 13:09:46 UTC

Verified the bug on SSSD Version: sssd-1.11.2-13.el7

The man page for sssd-ad has been updated with the following NOTES section:

NOTES
       The AD access control provider checks if the account is expired. It has the same effect as the following configuration of the LDAP
       provider:

           access_provider = ldap
           ldap_access_order = expire
           ldap_account_expire_policy = ad

       However, unless the “ad” access control provider is explicitly configured, the default access provider is “permit”.

Comment 3 Ludek Smid 2014-06-13 10:28:20 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.