[SSSD] Design Discussion: Active Directory DNS updates

Simo Sorce simo at redhat.com
Mon Mar 18 19:21:39 UTC 2013


On Mon, 2013-03-18 at 20:04 +0100, Jakub Hrozek wrote:
> On Mon, Mar 18, 2013 at 02:25:15PM -0400, Simo Sorce wrote:
> > On Mon, 2013-03-18 at 18:47 +0100, Jakub Hrozek wrote:
> > > On Mon, Mar 18, 2013 at 10:27:13AM -0400, Simo Sorce wrote:
> > > > On Mon, 2013-03-18 at 15:09 +0100, Jakub Hrozek wrote:
> > > > > On Mon, Mar 18, 2013 at 08:29:48AM -0400, Simo Sorce wrote:
> > > > > > On Mon, 2013-03-18 at 09:46 +0100, Jakub Hrozek wrote:
> > > > > > > 
> > > > > > > I'm all for generic shared code, but then it would sound like even
> > > > > > > LDAP
> > > > > > > provider for instance supports the dynamic updates..
> > > > > > 
> > > > > > This would be a positive feature imo.
> > > > > > 
> > > > > 
> > > > > Yes, but I was trying to say that given their provider-agnostic names,
> > > > > the options might confuse the user into setting them in an LDAP provider
> > > > > and expeciting them to work, while in reality only AD and IPA would be
> > > > > implemented.
> > > > 
> > > > I think it should a generic provider and AD and IPA should just have
> > > > different defaults, like with many other things.
> > > > 
> > > 
> > > OK, but we need to document that setting these options only has effect
> > > for the AD and IPA providers.
> > 
> > Any reason why we cannot make it work with arbitrary backends ?
> 
> How about authentication? Do you think it is reasonable to always
> presume GSS-TSIG? I'm afraid that going this way would force us to
> support a whole array of weird configuration and authentication options
> for all kinds of homebrew server configurations.

Well there are only 3 options: GSS-TSIG or TSIG or non-signed updates.
I guess we can have an option to mark what we'll be using and start
supporting only GSS-TSIG and non-signed.

I do not think we need to support TSIG right now, we could and it would
only add the need to point to a secret key, but we can leave it out for
now I think.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list