[SSSD] Design Discussion: Active Directory DNS updates

Jakub Hrozek jhrozek at redhat.com
Mon Mar 18 19:04:50 UTC 2013


On Mon, Mar 18, 2013 at 02:25:15PM -0400, Simo Sorce wrote:
> On Mon, 2013-03-18 at 18:47 +0100, Jakub Hrozek wrote:
> > On Mon, Mar 18, 2013 at 10:27:13AM -0400, Simo Sorce wrote:
> > > On Mon, 2013-03-18 at 15:09 +0100, Jakub Hrozek wrote:
> > > > On Mon, Mar 18, 2013 at 08:29:48AM -0400, Simo Sorce wrote:
> > > > > On Mon, 2013-03-18 at 09:46 +0100, Jakub Hrozek wrote:
> > > > > > 
> > > > > > I'm all for generic shared code, but then it would sound like even
> > > > > > LDAP
> > > > > > provider for instance supports the dynamic updates..
> > > > > 
> > > > > This would be a positive feature imo.
> > > > > 
> > > > 
> > > > Yes, but I was trying to say that given their provider-agnostic names,
> > > > the options might confuse the user into setting them in an LDAP provider
> > > > and expeciting them to work, while in reality only AD and IPA would be
> > > > implemented.
> > > 
> > > I think it should a generic provider and AD and IPA should just have
> > > different defaults, like with many other things.
> > > 
> > 
> > OK, but we need to document that setting these options only has effect
> > for the AD and IPA providers.
> 
> Any reason why we cannot make it work with arbitrary backends ?

How about authentication? Do you think it is reasonable to always
presume GSS-TSIG? I'm afraid that going this way would force us to
support a whole array of weird configuration and authentication options
for all kinds of homebrew server configurations.



More information about the sssd-devel mailing list