dirad

type Provider struct {
	// Scope restricts account synchronization to the configured directory
	// subtrees. An empty scope means the whole domain.
	Scope adclient.Scope

	// GroupScope restricts which groups are listed, stored as memberships, and
	// enforced by recovery policy. An empty scope means the whole local domain.
	//
	// Account and group scopes are separate because accounts and groups commonly
	// live in different containers. Memberships outside GroupScope are ignored;
	// in-scope memberships must resolve completely for live recovery decisions.
	GroupScope adclient.Scope

	// DomainController names the controller used for consistency-sensitive
	// directory reads: account enumeration and verification, group listing, live
	// account lookup, and the eligibility check before a recovery operation. Empty
	// means the agent discovers one.
	//
	// A configured controller is a constraint; a discovered one is refreshed after
	// dcTTL. Recovery reads and writes leave -Server unset so AD can select a
	// writable controller, and the Configure-time domain and search-base checks
	// use the module's default controller rather than this one.
	DomainController string

	// AllowPrivilegedAccounts permits recovery of accounts with nonzero
	// adminCount. It is false by default.
	AllowPrivilegedAccounts bool
	// contains filtered or unexported fields
}