On (20/11/15 12:25), Pavel Březina wrote:
>
https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOIPASchema
>
> = IPA sudo schema support =
>
> Related ticket(s):
> *
https://fedorahosted.org/sssd/ticket/1108
>
> Related design document(s)
> *
https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOCachingRules
>
> == Problem statement ==
>
> SSSD supports only standard sudo ldap schema at the moment. This has a
> drawback of having the need to run compat plugin that converts IPA sudo
> schema into the standard one. Once SSSD has support for IPA schema
> administrators administrators can disable sudo compat tree which will result
> in performance improvement.
>
> == Use cases ==
>
> * compat plugin may be disabled when using IPA sudo provider
>
> == IPA sudo schema ==
>
> IPA sudo schema is rather different than the standard one. This section
> contains the description of this schema together with ldap containers where
> sudo rules are stored. A relevant standard attribute is noted when possible.
> '''RDN is marked in bold'''. Attributes that hold dn are
marked in italic.
>
> ==== cn=sudocmds,cn=sudo,$dc ====
>
> This container contains definition of single commands that may be present in
> sudo rules.
>
> * objectClass = ipasudocmd
> * '''ipaUniqueID'''
> * sudoCmd ~ sudoCommand
> * ''memberOf'' (dn of sudo command group)
>
> ==== cn=sudocmdgroups,cn=sudo,$dc ====
>
> This container contains definition of command groups that may be present in
> sudo rules.
>
> * objectClass = ipasudocmdgroup
> * ipaUniqueID
> * '''cn'''
> * ''member'' (dn of sudo command)
>
> ==== cn=sudorules,cn=sudo,$dc ====
>
> This container contains definition of sudo rules.
>
> * objectClass = ipasudorule
> * '''ipaUniqueID'''
> * cn
> * ipaEnabledFlag
>
> * ipaSudoOpt ~ sudoOption
> * ''ipaSudoRunAs'' ~ sudoRunAsUser (dn of user or group of users)
> * ''ipaSudoRunAsGroup'' ~ sudoRunAsGroup (dn of group)
> * ''memberAllowCmd'' (dn of sudo command or command group)
> * ''memberDenyCmd'' (dn of sudo command or command group)
> * ''memberHost'' ~ sudoHost (dn of ipa enrolled machine or
hostgroup)
> * ''memberUser'' ~ sudoUser (dn of user or group of users)
> * hostMask (ip/mask)
>
> The following attibures have a special meaning and can contain only value
> "all". For example if cmdCategory is present, it is equivalent to
> sudoCommand=ALL.
>
> * cmdCategory ~ sudoCommand
> * hostCategory ~ sudoHost
> * ipaSudoRunAsGroupCategory ~ sudoRunAsGroup
> * ipaSudoRunAsUserCategory ~ sudoRunAsUser
> * userCategory ~ sudoUser
>
> The following attributes are used to contain external objects not known to
> IPA nor SSSD. Since SSSD by design provides rules only to users and groups
> known to it, we can safely ignore those attributes.
>
> * externalHost
> * externalUser
> * ipaSudoRunAsExtGroup
> * ipaSudoRunAsExtUser
>
> == Overview of the solution ==
>
> We will again use rules, smart and full refresh similar to what we do in ldap
> provider.
I thought that benefit of ipa sudo schema is that we can get rid of refresh
tasks. But I do not know details of ipa sudo schema.
Could you explain what are benefits of ipa sudo schema?
Except disabled compat plugin on IPA.
Unfortunately, there are not any benefits for the client side, only more
complicated processing. The task may possibly be disabled when we
implement sync repl.
LS
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org