On 01/28/2016 12:24 PM, Lukas Slebodnik wrote:
>On (27/01/16 16:30), Nikolai Kondrashov wrote:
>>On 01/27/2016 04:17 PM, Lukas Slebodnik wrote:
>>>You mention many options which could be possibly passed to tlog.
>>>e.g.
>>> TLOG_REC_CONF='{
>>> "shell": "/bin/bash",
>>> "warning": "WARNING! Your session is being
recorded!\n",
>>> "latency": 10,
>>> "writer": "syslog",
>>> "syslog": {
>>> "facility": "authpriv",
>>> "level": "info"
>>> }
>>> }'
>>>
>>>Where will be these option stored? In LDAP?
>>
>>No idea yet. Some of them definitely will, but likely not all.
>>
>In this case I would prefer to have the simplest change in sssd
>as possible.
https://fedorahosted.org/sssd/ticket/2893
>
>SSSD should just enforce using tlog as a shell and provide
>name of profile. This profile will be used by tlog to download
>configuration (json) from webservice.
>The similar approach was discussed with IPA integration with GNOME.
>IIRC there is already POC; Alexander might know more.
I think I understand the idea and perhaps storing configuration on a
webservice is fine. However, aren't we forgoing all the management
functionality LDAP provides by putting the configuration on a webservice?
I mean per-user, per-group, per-host, per-whatever configuration? Wouldn't
that require reimplementing them in that webservice? I don't really know much
about how that operates, and maybe that's fine, though.
Actually it would be a huge simplification.
You will have many profiles/configuration available via webservice
users and groups will have stored in LDAP just a name of profile/configuration.
So sssd would provide names of profiel instead of compicated structured
configration in tesxt (json, yaml, xml ...)
As I mentioned erarlier such appoach was discussed with GNOME team and
integration with FreeIPA/sssd. Alexander Bokovoy might know more
detail. Maybe it will be described in his FOSDEM presentation.
tlog can be a different use-case but it still worth to consider such approach.
Especialy if we could reuse exiting code/projects from GNOME.
LS