On (28/01/16 20:29), Nikolai Kondrashov wrote:
> On 01/28/2016 12:24 PM, Lukas Slebodnik wrote:
>> On (27/01/16 16:30), Nikolai Kondrashov wrote:
>>> On 01/27/2016 04:17 PM, Lukas Slebodnik wrote:
>>>> You mention many options which could be possibly passed to tlog.
>>>> e.g.
>>>> TLOG_REC_CONF='{
>>>> "shell": "/bin/bash",
>>>> "warning": "WARNING! Your session is being
recorded!\n",
>>>> "latency": 10,
>>>> "writer": "syslog",
>>>> "syslog": {
>>>> "facility": "authpriv",
>>>> "level": "info"
>>>> }
>>>> }'
>>>>
>>>> Where will be these option stored? In LDAP?
>>>
>>> No idea yet. Some of them definitely will, but likely not all.
>>>
>> In this case I would prefer to have the simplest change in sssd
>> as possible.
https://fedorahosted.org/sssd/ticket/2893
>>
>> SSSD should just enforce using tlog as a shell and provide
>> name of profile. This profile will be used by tlog to download
>> configuration (json) from webservice.
>> The similar approach was discussed with IPA integration with GNOME.
>> IIRC there is already POC; Alexander might know more.
>
> I think I understand the idea and perhaps storing configuration on a
> webservice is fine. However, aren't we forgoing all the management
> functionality LDAP provides by putting the configuration on a webservice?
>
> I mean per-user, per-group, per-host, per-whatever configuration? Wouldn't
> that require reimplementing them in that webservice? I don't really know much
> about how that operates, and maybe that's fine, though.
>
Actually it would be a huge simplification.
You will have many profiles/configuration available via webservice
users and groups will have stored in LDAP just a name of profile/configuration.
So sssd would provide names of profiel instead of compicated structured
configration in tesxt (json, yaml, xml ...)
As I mentioned erarlier such appoach was discussed with GNOME team and
integration with FreeIPA/sssd. Alexander Bokovoy might know more
detail. Maybe it will be described in his FOSDEM presentation.
tlog can be a different use-case but it still worth to consider such approach.
Especialy if we could reuse exiting code/projects from GNOME.
Alright, perhaps. I'll try to talk to Alexander when I have a chance and we
can discuss this further on our tlog integration meeting, which we're trying
to schedule.
Nick