On Thu, Jan 31, 2013 at 09:43:09AM -0500, Simo Sorce wrote:
On Thu, 2013-01-31 at 10:49 +0100, Sumit Bose wrote:
> Hi,
>
> I have created a design page for
>
https://fedorahosted.org/sssd/ticket/1032 "[RFE] sssd should support DNS
> sites" at
>
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryDNSSites .
> It can be found below as well.
>
> Corrections, comments and enhancements are welcome.
Good start, comments inline!
> struct tevent_req *resolv_getsrv_site_send(TALLOC_CTX *mem_ctx,
> struct tevent_context *ev,
> struct resolv_ctx *ctx,
> struct site_ctx *site_ctx,
> const char *service,
> const char *domain);
I do not think you should have a site_ctx and a resolv_ctx, one or the
other.
If you added site_ctx with the idea of calling this function recursively
then I would object to that, you should have a higher level internal
public function that does the whole processing and an internal private
one that is called multiple times and conceal internal requirements.
no, I didn't plan to use it recursively. The idea was to have both of
the functions you suggested in one. If site_ctx is NULL,
resolv_getsrv_site_send() will do get_site and then srv_by_site. The
found site is returned with the corresponding _recv() call so that in
later lookups the get_site step can be skipped.
If the provider goes offline the saved site_ctx will be deleted so that
the get_site step is done again when the provider goes online again.
Instead of using a plain char * for the site I took a struct to safe
e.g. the nearest site, if available, to have a better fallback step then
just Default-First-Site-Name.
Also I do not know that we really need to specify the service.
I thought it is all about finding a specific service in a site? The
current resolv_getsrv_send() call only accepts a single string like
_service._prot.domain.name. But since we need to put the site string
between the service part and the domain part I wanted to avoid
error prone splitting of the string in resolv_getsrv_site_send() and
preferred to have to two parts as separate strings.
The site is independent from the service you want to get. So we should
probably have a call that returns the site and a separate call that gets
the site name as input to get a specific service.
So I would have something like this:
struct tevent_req *resolv_get_site_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct resolv_ctx *ctx,
const char *domain);
And separately:
struct tevent_req *resolv_srv_by_site_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct resolv_ctx *ctx,
const char *site,
const char *domain);
> ==== Finding a DC for the CLDAP ping ====
> To find any DC in the domain a Windows client, and samba as well, look
> for a _ldap._tcp service record. The only difference is that samba
> uses a plain _ldap._tcp.domain.name while a Windows client
> _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.domain.name. I
> guess it will fall back to _ldap._tcp.domain.name if the other name
> cannot be resolved. I would suggest to use _ldap._tcp.domain.name for
> the SSSD implementation.
Why ? Using the Default-First-Site-Name one is technically more correct
when multiple sites are in use.
Will this return all DCs or only the ones that are not assigned to a
specific site? I just thought _ldap._tcp.domain.name will return a
larger number of DCs to choose from? But I'm not against using the
Default-First-Site-Name one here.
Besides that, you mentioned localized version of
Default-First-Site-Name. Would this be an argument against using it?
bye,
Sumit