On Thu, Feb 09, 2012 at 06:05:30PM +0100, Jan Zelený wrote:
> > > On Thu, 2012-02-09 at 13:46 +0100, Jakub Hrozek wrote:
> > > > On Tue, Feb 07, 2012 at 01:40:39PM +0100, Jan Zelený wrote:
> > > > > With all these changes happening in last two weeks, the IPA
hosts
> > > > > code was messy at best. This patch sorts out some of the mess.
I
> > > > > already did some testing: SELinux and HBAC seem to be working
> > > > > correctly. Honza, please take a look and test this patch with
> > > > > your SSH-related code. That is the last code that uses host
> > > > > fetching.
> > > > >
> > > > > If this patch makes it to master, I plan to do some more
cleanup
> > > > > in the HBAC code which is closely related to the code this
patch
> > > > > cleans.
> > > > >
> > > > > Thanks
> > > > > Jan
> > > >
> > > > None of the new options is documented or has a configAPI entry. If
> > > > that's intentional to avoid breaking string freeze, then there
> > > > should be a ticket to track adding them.
> > >
> > > They still need to be in the sssd.api.d/sssd-ipa.conf file. We can
> > > omit the strings from SSSDConfig.py to avoid breaking string freeze
> > > I guess. But the API needs to not choke on them if they're specified
> > > in the config file.
> > >
> > > Is this change necessary for the 1.8.0 release, or can we just fix it
> > > properly (with option changes) in 1.9.0?
> >
> > I guess we can leave it for 1.9, the current state isn't breaking
> > anything AFAIK.
> >
> > > > ...or...
> > > >
> > > > I was actually thinking if we want to document the IPA attribute
> > > > maps at all. The options clutter the manual page and their value
> > > > is questionable. Would anyone oppose *removing* all the attribute
> > > > maps from the IPA manual page? Or at the very least moving them
> > > > into some section down at the bottom where noone would be confused
> > > > by the options.
> > >
> > > I'm in favor of removing any manpage entries that are of neglibible
> > > utility (in 1.9.0, not 1.8.0).
> >
> > Agreed. I'll file a ticket for that.
> >
> > I'll send updated patch for master in a moment
>
> Filed ticket
https://fedorahosted.org/sssd/ticket/1187
>
> Patches are in attachment.
>
> Jan
The patch works fine but have you considered moving "sdap_attr_map
*selinuxuser_map", host_map and hostgroup_map into struct ipa_options?
It seems odd that the search bases are in struct ipa_options but maps
are in sdap_options. Also ipa_options seems like a better fit for
IPA-specific data.