On Fri, Dec 16, 2011 at 02:02:11PM +0100, Pavel Březina wrote:
yay!
These patches *assume* that "Responders: Split getting domain by
name into separate function" patch has been applied, it can be found
in "Ability to set a domain as case sensitive or insensitive"
thread.
Design page:
https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOIntegrationNewApproach
What's left:
1. implementing support of sssd in sudo sudoers plugin
This is Daniel's part using the API we provided. The whole sudo
integration feature could be moved out of "experimental" stage when
there's sudo package that is able to talk to SSSD.
One thing I'd like to get feedback on at this point is how do we
collaborate on the API with sudo.
The API is a collection of functions that are able to pack the sudo
request and send it over the socket to SSSD and parse the wire data
received from SSSD.
I'm not sure it would be wise to release the API as a full-fledged shared
library (although technically it makes sense) - some distributions such
as RHEL keep their libraries ABI compatible for the lifetime of the
distribution. What if we need to modify the API next release?
So far, Daniel just copied the API source into his WIP sudo tree so he
could develop the sudo part.
2. periodical update of all rules
Basically an equivalent of the "enumerate" task.
https://fedorahosted.org/sssd/ticket/1110
3. provide documentation
Include all the options and the responder itself in the manual pages
https://fedorahosted.org/sssd/ticket/1109
4. in memory cache in responder
Based on the design discussed on the list
https://fedorahosted.org/sssd/ticket/1111
5. refactor DP request using "RESPONDER: Refactor DP requests
into
tevent_req style" patch
https://fedorahosted.org/sssd/ticket/1115
With a little more detail - I'd like to see a new tevent_req style request
along the lines of sss_dp_get_account_send/_done/_recv just for sudo
rules. I'd like to reuse sss_dp_get_account_int_* request - there's a
couple of lines that are account specific, but I believe we could reuse
and share the code after very little refactoring.
6. provide few more configuration options
https://fedorahosted.org/sssd/ticket/1116
7. support the IPA scheme
https://fedorahosted.org/sssd/ticket/1108
How to configure it:
1. configure --enable-all-experimental-features
2. sssd.conf:
services += sudo
domain options: sudo_provider, ldap_sudo_search_base
How to test it:
> sss_sudo_cli username
This will display rules for %username. It performs two lookups:
1. using native sssd api to get and display raw date (it prints
every byte as char so don't be scared of silly characters that are
shown instead of numbers)
2. using api that we provide to sudo and use it to display data in
user readable format
This is exactly what sudo will be doing so the SSSD part of the effort
is quite testable at the moment.
Big thanks to Jakub, who has written whole sysdb api and a big part
of responder.
Regards,
Pavel Březina.