On Thu, Oct 06, 2016 at 04:41:10PM +0200, Jakub Hrozek wrote:
Hi,
with Alexander's help, I wrote up a design page about how SSSD should
read Fleet Commander data from IPA and present them to the FC client
component. The SSSD part is described here:
https://fedorahosted.org/sssd/wiki/DesignDocs/FleetCommanderIntegration
and the IPA part is here:
https://github.com/abbra/freeipa-desktop-profile/blob/master/plugin/Featu...
For convenience, I copied the SSSD wiki page below. Comments are welcome!
...
==== Looking up the Fleet Commander profiles and storing the JSON profile data ====
Since the first implementation will only fetch rules that are linked to
this host and the user in question, the SSSD's session provider will issue
an LDAP search along these lines:
{{{
(&(objectclass=ipadeskprofilerule)(memberHost=my_fqdn_or_my_host_group)(memberUser=user_login_or_group))
}}}
All host groups the IPA client is a member of must be included in the
`memberHost` part of the filter. Additionally, all user groups must be
included in the `memberUser` part of the filter. Since in most cases,
the user's groups will be resolved during the login, we will only issue
an initgroups request in case the user's initgroups are expired already
to cover cases where the sessions provider was invoked separately.
I wonder if it would be more efficient to read all profiles which apply
to the host in a single run store them in the cache and do the remaining
part of the processing locally? Iirc this is what we do with HBAC rules
and there might be a chance to reuse some of the HBAC code but just look
for objectclass ipadeskprofilerule instead of ipahbacrule?
Since there are host and user categories mentioned on the server side
design page I guess the underlying objectclass is ipaAssociation and
because of this it makes even more sense to reuse as much of the HBAC
lookup code as possible.
The host groups are typically also resolved by the IPA access control
provider, but currently not cached. In the initial implementation, we can
just search the host groups again, but subsequent patches should optimize
the searches by storing the host groups in the cache or in an intermediate
in-memory result.
If the same scheme as for the HBAC is used (see above) it might no be
necessary to cache the host groups (with the side-effect that all
profiles which apply to the host must be cached :-)
bye,
Sumit
>
> The LDAP search will include the Fleet Commander payload data in the
> profile's `data` attribute. Once the data are known, SSSD will write them
> to the disk. Since writing to the disk is typically quite fast
>
> The JSON files will be stored in a new directory owned by the `sssd-ipa`
> subpackage. The top-level directory could be at `/var/lib/sss/fleetcmd/`
> with per-user subdirectories. So each per-user JSON file would be stored at
> `/var/lib/sss/fleetcmd/<username>/<profilename>.json`. The
`<username>`
> directories need to be owned by the user being logged in.
>
> The `<profilename.json>` file must include the priority as a number which
> is read from the rule's `prio` attribute. The Fleet Commander client deamon
> will then process the JSON files in this priority. The filenames must also
> be normalized so that characters with a special meaning in shell are escaped
> and spaces are converted to another character such as underscores. Please
> refer to the IPA design page for more details.
>
> In the first version, the profiles will always be written again. In the
> future, we might want to optimize the process further by only writing the
> JSON profiles if they differ from what's already stored on the disk. This
> might be doable by storing the modifyTimestamp in the JSON profiles again,
> if FC is able to ignore certain JSON key-value pairs that would be private
> to SSSD or just storing the largest USN value of the found profiles in
> the included directory in a specially-named file.
>
> === Configuration changes ===
> Two new configuration options will be added:
> * `session_provider` that will be inherited from the `id_provider` value, so for
IPA clients, this provider will default to `ipa`. A default `session_provider` for other
providers will just shortcut and return success.
> * An option that enables the FC rules and profiles processing. A proposed option
name is `ipa_enable_fleetcmd` with boolean semantics.
>
> === How To Test ===
> Please see the use-cases above.
>
> === How To Debug ===
> DEBUG messages will be added to the new session provider so that the admin
> can trace if the session provider was invoked at all. An easy way to debug
> the integration is to enable the sessions provider and the FleetCommander
> integration manually w/o dropping the file by the FC client side daemon.
>
> === Authors ===
> * Alexander Bokovoy
> * Jakub Hrozek
> _______________________________________________
> sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org