On 11/24/2015 10:51 AM, Jakub Hrozek wrote:
On Tue, Nov 24, 2015 at 10:44:51AM +0100, Pavel Březina wrote:
>>> === Configuration changes ===
>>>
>>> * new option sudo_schema = [ipa|native]
>>
>> I would actually do it the other way around or even just let the admin
>> choose by selecting a non-default ldap_sudo_search_base. But I think we
>> should use the new schema by default.
>
> What do you mean by the other way around?
I think we should default to using the netive schema, not ou=sudoers and
only offer an option to fall back to the ou=sudoers schema.
native mean standard sudo schema for me... so to clarify, you mean
"native ipa schema" or "native ldap schema"? :-)
The fallback can happen either with setting some reserved
sudo_schema
value or pointing the ldap_sudo_base option to ou=sudoers.
So we will default to ipa schema and if search base is set to anything
else then cn=sudo,$dc, we will use ldap schema. We won't introduce any
new option. Does this sound right?