On 08/04/2014 09:11 PM, John Dennis wrote:
On 08/04/2014 07:48 AM, Jan Safranek wrote:
On 07/30/2014 02:42 PM, Martin Kosek wrote:
This is the main set of use cases, we will be looking forward to your recommendation on how to address them with OpenLMI. We would be also interested whether you would recommend designing&implementing simply via our own CIM model, not integrated in DMTF ecosystem (i.e. mostly just implementing RPC interface) or rather going the hard way and follow the DMTF models and profiles?
DMTF does not say anything about AD or Kerberos server management. I would recommend to write your own models and make them as close to underlying implementation (DBus API or IPA libraries) as possible.
If CIM is just a protocol between various IPA components (e.g. GUI talking to remote IPA installation to turn itself to be a replica), it may be even proprietary, not documented and unstable. And it does not need to be CIM at all.
if CIM is used as public remote API to manage IPA, it _should_ be stable and somewhat generic to allow future modifications without breaking existing users of the API, but you know, sometimes is the best just to break the API. CIM allows versioning, so the client can check what version of the API remote server supports and adapt accordingly.
[2] http://www.openlmi.org/sites/default/files/doc/admin/openlmi-providers/0.4.2...
I don't agree that DTMF has nothing to say about Kerberos nor for that matter the type of things that IPA does. In 5 minutes of googling I came up with these, they are a reasonable starting point for further investigation concerning existing CIM models that would impact an IPA server and clients. I know there are more models that are relevant because I found them when I was researching in preparation for the realmd provider, this is just what I could find in a couple of minutes.
CIM_KerberosKeyDistributionCenter http://wbemservices.sourceforge.net/moftree/schema/CIM_KerberosKeyDistributi...
CIM_KerberosCredential http://schemas.dmtf.org/wbem/cim-html/2.39.0+/CIM_KerberosCredential.html
Well, yes, there are some classes that describe KDC & Kerberos ticket, but there is no profile for it, it seems abandoned. Look at them and you can reuse them if you find them appropriate, but it won't make you interoperable with others in any way.
CIM_Identity http://schemas.dmtf.org/wbem/cim-html/2/CIM_Identity.html
Simple Identity Management Profile http://www.dmtf.org/sites/default/files/standards/documents/DSP1034_1.1.0.pd...
Role Based Authorization Profile http://www.dmtf.org/sites/default/files/standards/documents/DSP1039_1.0.0.pd...
Certificate Management Profile http://www.dmtf.org/sites/default/files/standards/documents/DSP1096_1.0.0.pd...
Integrated Access and Control Policy Management Profile http://www.dmtf.org/sites/default/files/standards/documents/DSP1106_1.0.0_0....
These are profiles to describe users, groups, roles and policies. I got an impression that we're managing IPA server itself and not users and policies stored in it.
Dell Active Directory Client Profile http://media.community.dell.com/en/dtc/attach/dcim- active_directory_client_profile-1.0.pdf
This is Dell proprietary profile.
Jan