[SSSD] Design Discussion: Active Directory DNS updates

Jakub Hrozek jhrozek at redhat.com
Mon Mar 18 19:56:01 UTC 2013


On Mon, Mar 18, 2013 at 03:21:39PM -0400, Simo Sorce wrote:
> On Mon, 2013-03-18 at 20:04 +0100, Jakub Hrozek wrote:
> > On Mon, Mar 18, 2013 at 02:25:15PM -0400, Simo Sorce wrote:
> > > On Mon, 2013-03-18 at 18:47 +0100, Jakub Hrozek wrote:
> > > > On Mon, Mar 18, 2013 at 10:27:13AM -0400, Simo Sorce wrote:
> > > > > On Mon, 2013-03-18 at 15:09 +0100, Jakub Hrozek wrote:
> > > > > > On Mon, Mar 18, 2013 at 08:29:48AM -0400, Simo Sorce wrote:
> > > > > > > On Mon, 2013-03-18 at 09:46 +0100, Jakub Hrozek wrote:
> > > > > > > > 
> > > > > > > > I'm all for generic shared code, but then it would sound like even
> > > > > > > > LDAP
> > > > > > > > provider for instance supports the dynamic updates..
> > > > > > > 
> > > > > > > This would be a positive feature imo.
> > > > > > > 
> > > > > > 
> > > > > > Yes, but I was trying to say that given their provider-agnostic names,
> > > > > > the options might confuse the user into setting them in an LDAP provider
> > > > > > and expeciting them to work, while in reality only AD and IPA would be
> > > > > > implemented.
> > > > > 
> > > > > I think it should a generic provider and AD and IPA should just have
> > > > > different defaults, like with many other things.
> > > > > 
> > > > 
> > > > OK, but we need to document that setting these options only has effect
> > > > for the AD and IPA providers.
> > > 
> > > Any reason why we cannot make it work with arbitrary backends ?
> > 
> > How about authentication? Do you think it is reasonable to always
> > presume GSS-TSIG? I'm afraid that going this way would force us to
> > support a whole array of weird configuration and authentication options
> > for all kinds of homebrew server configurations.
> 
> Well there are only 3 options: GSS-TSIG or TSIG or non-signed updates.
> I guess we can have an option to mark what we'll be using and start
> supporting only GSS-TSIG and non-signed.
> 
> I do not think we need to support TSIG right now, we could and it would
> only add the need to point to a secret key, but we can leave it out for
> now I think.

OK, in general this plan sounds good. I have amended the design page
again:
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryDNSUpdates?action=diff&version=9&old_version=8

The other concern I have is the time constraints. I would rather focus
on having the infrastructure ready and well tested in all providers for
1.10 but only rigorously testing and documenting the options in IPA and
man AD for 1.10 as stated in the design page. Or alternatively, including
the support as an experimental feature which wouldn't turn up in Fedora
in RHEL but could enabled with a simple configure switch.



More information about the sssd-devel mailing list