We have an operational need to track the userClass attribute for our IPA
hosts over time, specifically in a git repository (don't ask).
I thought of several ways of doing this and I am looking for suggestions as
to the best option. I also want to make the smallest possible modifications
to FreeIPA.
1. Monitor the `cn=changelog` tree for changes affecting hosts. We would
keep the last date our script ran and query the tree for items more recent
than that. The major issue is that it doesn't look like you can query for
">=" against modifyTimestamp (at least, I get no results).
2. I found references to FreeIPA using `RFC 4533` instead of the old
changelog sync. It seems like that might have been superseded by RFC 3928,
but I can't find any documentation about that. I have also found references
to 389ds supporting Persistent Searches, but again there doesn't seem to be
great documentation. I am not sure I want to implement something without
documentation about it being a supported feature.
Both options 1 and 2 would probably need a full sync every so often to make
sure they didn't miss changes.
3. Create a FreeIPA plugin. This seems like overkill since I just need LDAP
data and we would need to make sure it gets installed on all of our systems.
4. Just schedule a normal LDAP query every so often (i.e. maybe once an
hour) and assume that changes aren't made so quickly that anything
important would be lost. I like this option least since I don't know that I
can trust that assumption.
Any thoughts about these (or other) methods?
Thank you,
- Y
Show replies by date