On Mon, 2012-02-27 at 14:54 +0100, Ondrej Valousek wrote:
> Of course it should be possible to dig out that information by
> grepping logs or by using ldapsearch but with several domains
> configured (and in the future trusts and sub-domains also in play)
> it's getting a bit laborious to manually construct LDAP queries for
> each domain or plunge into cache files to find out information about
> a user's origin or group memberships instead of just doing something
> like "sss_search -u jdoe", just as Ondrej says.
>
> If a specific action Ondrej suggests wouldn't work with certain
> types of domains the tool could just inform the administrator about
> the fact that those domains are not included in the results. The
> administrator could then decide next steps depending on the
> situation at hand, at least all the information possible to retrieve
> on the client side for the domains configured would be easily
> available.
>
> Thanks,
>
Well, I understand that not all features would be available for all
backends, but to be honest, to me is sssd synonym for a robust
ldap-client - so I imagine sssd would be in a vast majority used with
ldap/IPA backend.
As Marko said, "sss_search -u jdoe" would be nice. I also expect it to
return more than what 'getent' does - i.e. things like mail address,
telephone number,... ok these might not be important now, but
certainly will be in the future (imagine sssd being queried by mailing
client or ekiga/pidgin).
Also, having the information about ldap connection state (i.e. sssd
running in connected or disconnected mode) is extremely useful to me
as one the biggest pain with winbind is its cache - you never know
which information came from the authoritative source and which was
just cached & winbind can not bind to any server due to whatever
reason.
These are certainly worth considering. The preferred method of
requesting such changes is to file enhancement tickets at
https://fedorahosted.org/sssd so that they will not get forgotten and
can be scheduled appropriately.